theory Tcb_C

lemma decodeTCBInvocation_ccorres:
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple
              and valid_cap' cp and cte_at' slot and K (isThreadCap cp)
              and (excaps_in_mem extraCaps o ctes_of)
              and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp)
              and (\<lambda>s. \<forall>v \<in> set extraCaps. \<forall>y \<in> zobj_refs' (fst v).
                              ex_nonz_cap_to' y s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             s \<turnstile>' fst v \<and> cte_at' (snd v) s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             ex_cte_cap_wp_to' isCNodeCap (snd v) s)
              and sysargs_rel args buffer)
       (UNIV
            \<inter> {s. invLabel_' s = label}
            \<inter> {s. ccap_relation cp (cap_' s)}
            \<inter> {s. unat (length___unsigned_long_' s) = length args}
            \<inter> {s. slot_' s = cte_Ptr slot}
            \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
            \<inter> {s. call_' s = from_bool isCall}
            \<inter> {s. buffer_' s = option_to_ptr buffer}) []
     (decodeTCBInvocation label args cp slot extraCaps
            >>= invocationCatch thread isBlocking isCall InvokeTCB)
     (Call decodeTCBInvocation_'proc)" apply (cinit' lift: invLabel_' cap_' length___unsigned_long_' slot_' current_extra_caps_' call_' buffer_') apply (simp add: decodeTCBInvocation_def invocation_eq_use_types gen_invocation_type_eq
               del: Collect_const) apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeReadRegisters_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeWriteRegisters_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeCopyRegisters_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply (simp add: returnOk_bind ccorres_invocationCatch_Inr) apply (rule ccorres_rhs_assoc)+ apply (ctac add: setThreadState_ccorres) apply csymbr apply (simp add: performInvocation_def) apply (ctac add: invokeTCB_Suspend_ccorres) apply simp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (vcg exspec=invokeTCB_Suspend_modifies) apply (wp sts_invs_minor') apply (vcg exspec=setThreadState_modifies) apply (rule ccorres_Cond_rhs) apply (simp add: returnOk_bind ccorres_invocationCatch_Inr) apply (rule ccorres_rhs_assoc)+ apply (ctac add: setThreadState_ccorres) apply csymbr apply (simp add: performInvocation_def) apply (ctac add: invokeTCB_Resume_ccorres) apply simp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (vcg exspec=invokeTCB_Resume_modifies) apply (wp sts_invs_minor') apply (vcg exspec=setThreadState_modifies) apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeTCBConfigure_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeSetPriority_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeSetMCPriority_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeSetSchedParams_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeSetIPCBuffer_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeSetSpace_ccorres [where buffer=buffer]) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeBindNotification_ccorres) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeUnbindNotification_ccorres) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_Cond_rhs) apply (simp add: gen_invocation_type_eq) apply (rule ccorres_add_returnOk, ctac(no_vcg) add: decodeSetTLSBase_ccorres) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (rule ccorres_equals_throwError) apply (fastforce simp: throwError_bind invocationCatch_def
                   split: invocation_label.split gen_invocation_labels.split) apply (simp add: ccorres_cond_iffs
              cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (clarsimp simp: cintr_def intr_and_se_rel_def
                        exception_defs rf_sr_ksCurThread
                        Collect_const_mem) apply (rule conjI) apply (auto simp: ct_in_state'_def isCap_simps valid_tcb_state'_def
              elim!: pred_tcb'_weakenE
              dest!: st_tcb_at_idle_thread')[1] apply (simp split: sum.split add: cintr_def intr_and_se_rel_def
                        exception_defs syscall_error_rel_def) apply (simp add: "StrictC'_thread_state_defs" mask_eq_iff_w2p word_size
                   cap_get_tag_isCap) apply (simp add: cap_get_tag_isCap[symmetric], drule(1) cap_get_tag_to_H) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>\<acute>invLabel = label\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeTCBInvocation label args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeTCBInvocation_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6694 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) (?Q'6694 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) [SKIP] (decodeTCBInvocation label args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBReadRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeReadRegisters_'proc(cap,length___unsigned_long,calla,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBWriteRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,slota,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,slota,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,slota,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF invLabel = SCAST(32 signed \<rightarrow> 32) Kernel_C.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q6694 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s \<and> s' \<in> ?Q'6694 buffera calla current_extra_caps slota length___unsigned_long cap invLabel proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6694 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?Q'6694 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBReadRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeReadRegisters_'proc(cap,length___unsigned_long,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q6694 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s \<and> s' \<in> ?Q'6694 buffera calla current_extra_caps slota length___unsigned_long cap invLabel proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6705 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S6708 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeReadRegisters_'proc(cap,length___unsigned_long,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6706 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> ?Q6705 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> ?R6704 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> ?S6708 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> ?T6706 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6705 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S6708 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeReadRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeReadRegisters_'proc(cap,length___unsigned_long,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6706 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> ?Q6705 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> ?R6704 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> ?S6708 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> ?T6706 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBReadRegisters; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6723 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'6743 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBReadRegisters; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6723 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''6741 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6735 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeReadRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q6723 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE6723 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6706 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and ?R6735 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> ?R6704 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'6742 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''6740 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> ?T6706 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'6743 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'6742 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''6741 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''6740 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBReadRegisters; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6723 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''6741 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6735 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeReadRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE6723 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6706 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and ?R6735 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> ?R6704 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''6740 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> ?T6706 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''6741 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''6740 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6735 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeReadRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6706 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and ?R6735 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> ?R6704 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> ?T6706 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6706 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> ?R6704 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> ?T6706 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6833 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S6836 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6832 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6834 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> ?Q6833 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> ?R6832 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> ?S6836 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> ?T6834 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6833 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S6836 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeWriteRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeWriteRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6832 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6834 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> ?Q6833 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> ?R6832 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> ?S6836 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> ?T6834 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6856 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'6876 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6856 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''6874 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6868 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeWriteRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q6856 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE6856 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6832 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6834 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and ?R6868 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> ?R6832 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'6875 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''6873 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> ?T6834 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'6876 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'6875 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''6874 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''6873 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6856 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''6874 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6868 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeWriteRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE6856 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6832 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6834 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and ?R6868 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> ?R6832 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''6873 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> ?T6834 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''6874 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''6873 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6868 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeWriteRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6832 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6834 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and ?R6868 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> ?R6832 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> ?T6834 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6832 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6834 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters THEN
  \<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> ?R6832 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> ?T6834 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6966 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S6969 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6965 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6967 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> ?Q6966 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> ?R6965 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> ?S6969 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> ?T6967 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6966 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S6969 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeCopyRegisters args cp (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeCopyRegisters_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6965 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6967 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> ?Q6966 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> ?R6965 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> ?S6969 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> ?T6967 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6994 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'7016 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6994 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''7014 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R7006 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeCopyRegisters args cp (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q6994 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE6994 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6965 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6967 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and ?R7006 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> ?R6965 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'7015 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''7013 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> ?T6967 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'7016 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'7015 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''7014 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''7013 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6994 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''7014 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R7006 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeCopyRegisters args cp (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE6994 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6965 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6967 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and ?R7006 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> ?R6965 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''7013 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> ?T6967 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''7014 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''7013 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R7006 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeCopyRegisters args cp (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6965 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6967 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and ?R7006 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> ?R6965 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> ?T6967 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6965 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T6967 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSuspend THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> ?R6965 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> ?T6967 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7110 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S7113 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ?Q7110 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?S7113 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7110 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S7113 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.Suspend (capTCBPtr cp)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ?Q7110 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?S7113 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7110 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S7113 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.Suspend (capTCBPtr cp)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ?Q7110 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?S7113 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7152 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'7152 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv xfdc) [SKIP] (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.Suspend (capTCBPtr cp)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q7152 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'7152 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s)}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7152 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?G'7200 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv xfdc ret__unsigned) [SKIP] (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.Suspend (capTCBPtr cp)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q7152 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'7200 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7152 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()) (?G'7200 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (doE reply <- invokeTCB (tcbinvocation.Suspend (capTCBPtr cp));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q7152 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'7200 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv) (?Q'7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv ret__unsigned_long) [SKIP] (if rv = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rv isCall)) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err) (?Q''7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Suspend (capTCBPtr cp)) \<lbrace>?Q7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>, \<lbrace>?QE7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7275 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> ?Q'7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and ?R7282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7275 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7274 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) []) (?Q'7274 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err) (?Q''7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Suspend (capTCBPtr cp)) \<lbrace>?Q7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>, \<lbrace>?QE7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7275 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> ?Q'7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and ?R7282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7275 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7274 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) []) (?Q'7274 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err) (?Q''7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Suspend (capTCBPtr cp)) \<lbrace>?Q7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>, \<lbrace>?QE7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7275 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> ?Q'7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and ?R7282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7275 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err) (?Q''7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Suspend (capTCBPtr cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7275 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7274 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and ?R7282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7275 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 7. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Suspend (capTCBPtr cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7275 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and ?R7282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7275 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7275 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Suspend_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7275 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<lbrace>?R7160 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7160 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7153 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7153 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7109 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7111 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBResume THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> ?R7109 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> ?T7111 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7490 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S7493 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ?Q7490 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?S7493 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7490 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S7493 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.Resume (capTCBPtr cp)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ?Q7490 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?S7493 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7490 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S7493 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.Resume (capTCBPtr cp)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ?Q7490 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?S7493 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7537 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'7537 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv xfdc) [SKIP] (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.Resume (capTCBPtr cp)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q7537 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'7537 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s)}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7537 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?G'7585 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv xfdc ret__unsigned) [SKIP] (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.Resume (capTCBPtr cp)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q7537 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'7585 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7537 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()) (?G'7585 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (doE reply <- invokeTCB (tcbinvocation.Resume (capTCBPtr cp));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q7537 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'7585 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv) (?Q'7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv ret__unsigned_long) [SKIP] (if rv = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rv isCall)) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err) (?Q''7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7667 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Resume (capTCBPtr cp)) \<lbrace>?Q7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>, \<lbrace>?QE7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7660 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> ?Q'7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and sch_act_simple and ?R7667 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7660 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7659 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) []) (?Q'7659 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err) (?Q''7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7667 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Resume (capTCBPtr cp)) \<lbrace>?Q7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>, \<lbrace>?QE7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7660 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> ?Q'7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and sch_act_simple and ?R7667 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7660 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rv = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7659 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) []) (?Q'7659 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err) (?Q''7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7667 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Resume (capTCBPtr cp)) \<lbrace>?Q7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>, \<lbrace>?QE7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7660 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> ?Q'7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned rv (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and sch_act_simple and ?R7667 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7660 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err) (?Q''7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7667 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Resume (capTCBPtr cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7660 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7659 buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and sch_act_simple and ?R7667 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7660 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 7. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7667 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label ()\<rbrace> invokeTCB (tcbinvocation.Resume (capTCBPtr cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7660 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and sch_act_simple and ?R7667 buffera calla current_extra_caps slota length___unsigned_long cap invLabel a\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7660 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7660 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_Resume_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and sch_act_simple and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'7660 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<lbrace>?R7545 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and sch_act_simple and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7545 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7538 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'7538 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7489 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7491 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBConfigure THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> ?R7489 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> ?T7491 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label = gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7875 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S7878 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7874 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7876 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> ?Q7875 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> ?R7874 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> ?S7878 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> ?T7876 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7875 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S7878 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeTCBConfigure args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeTCBConfigure_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7874 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7876 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> ?Q7875 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> ?R7874 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> ?S7878 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> ?T7876 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBConfigure; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7918 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'7940 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBConfigure; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7918 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''7938 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> \<lbrace>?R7930 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeTCBConfigure args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q7918 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE7918 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7874 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7876 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R7930 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> ?R7874 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'7939 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''7937 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> ?T7876 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'7940 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'7939 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''7938 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''7937 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBConfigure; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7918 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''7938 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> \<lbrace>?R7930 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeTCBConfigure args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE7918 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7874 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7876 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R7930 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> ?R7874 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''7937 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> ?T7876 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''7938 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''7937 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> \<lbrace>?R7930 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeTCBConfigure args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7874 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7876 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R7930 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> ?R7874 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> ?T7876 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7874 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T7876 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> ?R7874 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> ?T7876 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label = gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8034 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8037 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8033 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8035 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> ?Q8034 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> ?R8033 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> ?S8037 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> ?T8035 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8034 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8037 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeSetPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8033 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8035 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> ?Q8034 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> ?R8033 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> ?S8037 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> ?T8035 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetPriority; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8082 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'8104 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetPriority; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8082 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8102 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> \<lbrace>?R8094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q8082 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE8082 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8033 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8035 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> ?R8033 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'8103 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8101 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> ?T8035 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'8104 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'8103 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''8102 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8101 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetPriority; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8082 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8102 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> \<lbrace>?R8094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE8082 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8033 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8035 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> ?R8033 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8101 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> ?T8035 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''8102 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8101 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> \<lbrace>?R8094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8033 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8035 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> ?R8033 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> ?T8035 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8033 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8035 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority THEN
  \<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> ?R8033 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> ?T8035 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8198 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8201 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8197 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8199 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> ?Q8198 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> ?R8197 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> ?S8201 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> ?T8199 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8198 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8201 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeSetMCPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetMCPriority_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8197 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8199 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> ?Q8198 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> ?R8197 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> ?S8201 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> ?T8199 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8251 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'8273 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8251 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8271 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> \<lbrace>?R8263 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetMCPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q8251 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE8251 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8197 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8199 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8263 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> ?R8197 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'8272 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8270 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> ?T8199 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'8273 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'8272 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''8271 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8270 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8251 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8271 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> \<lbrace>?R8263 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetMCPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE8251 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8197 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8199 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8263 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> ?R8197 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8270 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> ?T8199 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''8271 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8270 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> \<lbrace>?R8263 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetMCPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8197 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8199 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8263 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> ?R8197 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> ?T8199 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8197 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8199 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> ?R8197 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> ?T8199 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8367 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8370 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8366 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8368 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> ?Q8367 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> ?R8366 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> ?S8370 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> ?T8368 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8367 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8370 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeSetSchedParams args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetSchedParams_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8366 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8368 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> ?Q8367 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> ?R8366 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> ?S8370 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> ?T8368 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8425 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'8447 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8425 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8445 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> \<lbrace>?R8437 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetSchedParams args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q8425 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE8425 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8366 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8368 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8437 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> ?R8366 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'8446 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8444 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> ?T8368 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'8447 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'8446 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''8445 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8444 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8425 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8445 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> \<lbrace>?R8437 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetSchedParams args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE8425 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8366 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8368 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8437 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> ?R8366 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8444 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> ?T8368 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''8445 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8444 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> \<lbrace>?R8437 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetSchedParams args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8366 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8368 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and ?R8437 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> ?R8366 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> ?T8368 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8366 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8368 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer THEN
  \<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> ?R8366 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> ?T8368 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8541 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8544 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8540 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8542 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> ?Q8541 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> ?R8540 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> ?S8544 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> ?T8542 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8541 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8544 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeSetIPCBuffer args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetIPCBuffer_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8540 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8542 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> ?Q8541 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> ?R8540 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> ?S8544 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> ?T8542 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8604 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'8626 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8604 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8624 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetIPCBuffer args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q8604 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE8604 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8540 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8542 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R8616 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> ?R8540 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'8625 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8623 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> ?T8542 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'8626 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'8625 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''8624 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8623 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8604 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8624 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetIPCBuffer args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE8604 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8540 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8542 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R8616 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> ?R8540 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8623 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> ?T8542 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''8624 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8623 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetIPCBuffer args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8540 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8542 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R8616 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> ?R8540 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> ?T8542 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8540 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8542 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetSpace THEN
  \<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> ?R8540 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> ?T8542 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label = gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8720 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8723 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8719 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8721 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> ?Q8720 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> ?R8719 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> ?S8723 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> ?T8721 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8720 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8723 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeSetSpace args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetSpace_'proc(cap,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8719 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8721 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> ?Q8720 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> ?R8719 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> ?S8723 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> ?T8721 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSpace; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8788 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'8810 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSpace; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8788 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8808 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> \<lbrace>?R8800 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetSpace args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q8788 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE8788 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8719 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8721 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R8800 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> ?R8719 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'8809 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8807 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> ?T8721 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'8810 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'8809 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''8808 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8807 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSpace; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8788 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8808 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> \<lbrace>?R8800 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetSpace args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE8788 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8719 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8721 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R8800 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> ?R8719 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8807 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> ?T8721 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''8808 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8807 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> \<lbrace>?R8800 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetSpace args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8719 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8721 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and ?R8800 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> ?R8719 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> ?T8721 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8719 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8721 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBBindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> ?R8719 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> ?T8721 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label = gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8904 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8907 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8903 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8905 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> ?Q8904 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> ?R8903 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> ?S8907 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> ?T8905 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8904 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S8907 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeBindNotification cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeBindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8903 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8905 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> ?Q8904 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> ?R8903 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> ?S8907 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> ?T8905 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBBindNotification; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8977 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'8999 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBBindNotification; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8977 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8997 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> \<lbrace>?R8989 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeBindNotification cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q8977 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE8977 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8903 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8905 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and ?R8989 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> ?R8903 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'8998 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8996 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> ?T8905 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'8999 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'8998 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''8997 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8996 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBBindNotification; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8977 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''8997 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> \<lbrace>?R8989 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeBindNotification cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE8977 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8903 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8905 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and ?R8989 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> ?R8903 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''8996 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> ?T8905 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''8997 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''8996 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> \<lbrace>?R8989 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeBindNotification cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8903 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8905 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and ?R8989 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> ?R8903 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> ?T8905 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8903 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T8905 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification THEN
  \<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> ?R8903 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> ?T8905 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9093 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S9096 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9092 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> ?Q9093 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> ?R9092 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> ?S9096 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> ?T9094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9093 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S9096 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeUnbindNotification cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeUnbindNotification_'proc(cap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9092 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> ?Q9093 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> ?R9092 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> ?S9096 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> ?T9094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9171 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'9191 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9171 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''9189 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> \<lbrace>?R9183 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeUnbindNotification cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q9171 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE9171 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9092 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and ?R9183 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> ?R9092 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'9190 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''9188 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> ?T9094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'9191 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'9190 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''9189 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''9188 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9171 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''9189 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> \<lbrace>?R9183 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeUnbindNotification cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE9171 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9092 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and ?R9183 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> ?R9092 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''9188 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> ?T9094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''9189 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''9188 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> \<lbrace>?R9183 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeUnbindNotification cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9092 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and ?R9183 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> ?R9092 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> ?T9094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9092 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9094 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase THEN
  \<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> ?R9092 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s)))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> ?T9094 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9281 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S9284 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?Q9281 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?S9284 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9281 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?S9284 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (decodeSetTLSBase args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeSetTLSBase_'proc(cap,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?Q9281 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?S9284 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase; dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9364 buffera calla current_extra_caps slota length___unsigned_long cap invLabel rv) (?Q'9384 length___unsigned_long cap rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9364 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''9382 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> \<lbrace>?R9376 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetTLSBase args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>?Q9364 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>, \<lbrace>?QE9364 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 5. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and ?R9376 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'9383 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''9381 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t rv. ?Q'9384 length___unsigned_long cap rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q'9383 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label
\<lambda>length___unsigned_long cap t err. ?Q''9382 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''9381 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9364 buffera calla current_extra_caps slota length___unsigned_long cap invLabel err) (?Q''9382 length___unsigned_long cap err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> \<lbrace>?R9376 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetTLSBase args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE9364 buffera calla current_extra_caps slota length___unsigned_long cap invLabel\<rbrace>
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and ?R9376 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''9381 buffera calla current_extra_caps slota length___unsigned_long cap invLabel t err))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})}
flex-flex pairs:
\<lambda>length___unsigned_long cap t err. ?Q''9382 length___unsigned_long cap err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap. ?Q''9381 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> \<lbrace>?R9376 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label\<rbrace> decodeSetTLSBase args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and ?R9376 buffera calla current_extra_caps slota length___unsigned_long cap invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> (case gen_invocation_type label of gen_invocation_labels.TCBReadRegisters \<Rightarrow> decodeReadRegisters args cp | gen_invocation_labels.TCBWriteRegisters \<Rightarrow> decodeWriteRegisters args cp | gen_invocation_labels.TCBCopyRegisters \<Rightarrow> decodeCopyRegisters args cp $ map fst extraCaps | gen_invocation_labels.TCBConfigure \<Rightarrow> decodeTCBConfigure args cp slot extraCaps | gen_invocation_labels.TCBSetPriority \<Rightarrow> decodeSetPriority args cp extraCaps | gen_invocation_labels.TCBSetMCPriority \<Rightarrow> decodeSetMCPriority args cp extraCaps | gen_invocation_labels.TCBSetSchedParams \<Rightarrow> decodeSetSchedParams args cp extraCaps | gen_invocation_labels.TCBSetIPCBuffer \<Rightarrow> decodeSetIPCBuffer args cp slot extraCaps | gen_invocation_labels.TCBSetSpace \<Rightarrow> decodeSetSpace args cp slot extraCaps | gen_invocation_labels.TCBSuspend \<Rightarrow> returnOk $ tcbinvocation.Suspend (capTCBPtr cp) | gen_invocation_labels.TCBResume \<Rightarrow> returnOk $ tcbinvocation.Resume (capTCBPtr cp) | gen_invocation_labels.TCBBindNotification \<Rightarrow> decodeBindNotification cp extraCaps | gen_invocation_labels.TCBUnbindNotification \<Rightarrow> decodeUnbindNotification cp | gen_invocation_labels.TCBSetTLSBase \<Rightarrow> decodeSetTLSBase args cp | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB = throwError (?v9470 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (throwError (?v9470 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9280 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) (?T9282 (option_to_ptr buffer) (from_bool isCall) extraCaps' (cte_Ptr slot) length___unsigned_long cap label) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> ?R9280 buffera calla current_extra_caps slota length___unsigned_long cap invLabel s))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> ?T9282 buffera calla current_extra_caps slota length___unsigned_long cap invLabel)})})})})})})})})})})})})})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend; gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume; gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace; gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification; gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetTLSBase\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> True))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> UNIV)})})})})})})})})})})})})})} proof (prove)
goal (1 subgoal):
 1. \<And>buffera calla current_extra_caps slota length___unsigned_long cap invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; calla = from_bool isCall; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> sch_act_simple a \<and> True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and excaps_in_mem extraCaps \<circ> ctes_of and K (isThreadCap cp) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and K (isThreadCap cp) and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and sysargs_rel args buffer and (\<lambda>a. True \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> True))))))))))))))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (slot_'_update (\<lambda>_. slota) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap) s \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>cap_' := cap, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (ret__unsigned_long_' t)) (errstate s)}))}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.TCBSetTLSBase \<longrightarrow> s \<in> UNIV)})})})})})})})})})})})})})} proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (\<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSuspend \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBResume \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetPriority \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSpace \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBBindNotification \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (\<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s)))))))))))) \<and> (gen_invocation_type label = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSuspend \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBResume \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBConfigure \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetPriority \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSpace \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBBindNotification \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (\<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSuspend \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBResume \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetPriority \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSpace \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBBindNotification \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (\<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s)))))))))))
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSuspend \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBResume \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBConfigure \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetPriority \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSpace \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBBindNotification \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBReadRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSuspend \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBResume \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBResume \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBConfigure \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBConfigure \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetPriority \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetMCPriority \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSchedParams \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetIPCBuffer \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSetSpace \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSetSpace \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBBindNotification \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBBindNotification \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBUnbindNotification \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBUnbindNotification \<longrightarrow> gen_invocation_type label = gen_invocation_labels.TCBSetTLSBase \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>err. (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate t) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate t)) \<longrightarrow> (case err of Inl se \<Rightarrow> syscall_error_rel se (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) | Inr irq \<Rightarrow> cintr irq (ret__unsigned_long_' t) (errstate (s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSuspend \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> gen_invocation_type label = gen_invocation_labels.TCBResume \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSuspend \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> gen_invocation_type label = gen_invocation_labels.TCBResume \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; excaps_in_mem extraCaps (ctes_of s); tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s; cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))\<rbrakk> \<Longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBReadRegisters \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBWriteRegisters \<longrightarrow> gen_invocation_type label \<noteq> gen_invocation_labels.TCBCopyRegisters \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.TCBSuspend \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.TCBSuspend \<longrightarrow> gen_invocation_type label = gen_invocation_labels.TCBResume \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) proof (prove)
goal:
No subgoals!