theory Invoke_C

lemma decodeDomainInvocation_ccorres:
  notes Collect_const[simp del]
  shows
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread)
              and sch_act_simple and ct_active'
              and (excaps_in_mem extraCaps \<circ> ctes_of)
              and (\<lambda>s. \<forall>v \<in> set extraCaps. \<forall>y \<in> zobj_refs' (fst v).
                              ex_nonz_cap_to' y s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             s \<turnstile>' fst v)
              and sysargs_rel args buffer)
       (UNIV
             \<inter> {s. unat (length___unsigned_long_' s) = length args}
             \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
             \<inter> {s. call_' s = from_bool isCall}
             \<inter> {s. invLabel_' s = lab}
             \<inter> {s. buffer_' s = option_to_ptr buffer}) []
       (decodeDomainInvocation lab args extraCaps
           >>= invocationCatch thread isBlocking isCall (uncurry InvokeDomain))
  (Call decodeDomainInvocation_'proc)" supply gen_invocation_type_eq[simp] apply (cinit' lift: length___unsigned_long_' current_extra_caps_' call_' invLabel_' buffer_'
                simp: decodeDomainInvocation_def list_case_If2 whenE_def) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: throwError_bind invocationCatch_def invocation_eq_use_types
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: invocation_eq_use_types) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: throwError_bind invocationCatch_def
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: unat_gt_0[symmetric] del:) apply (rule ccorres_add_return) apply (rule ccorres_rhs_assoc)+ apply (ctac add: getSyscallArg_ccorres_foo[where args=args and n=0 and buffer=buffer]) apply (simp add: hd_conv_nth word_le_nat_alt) apply (simp add: unat_scast_numDomains) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: throwError_bind invocationCatch_def
                       hd_conv_nth word_le_nat_alt unat_numDomains_to_H
                 cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: null_def excaps_map_def unat_numDomains_to_H) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: throwError_bind invocationCatch_def
                       interpret_excaps_test_null
                 cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: interpret_excaps_test_null hd_conv_nth cap_case_ThreadCap2) apply (rule ccorres_add_return) apply (rule_tac r'="(\<lambda>rv _ rv'. ((cap_get_tag rv' = scast cap_thread_cap)
                                          = (isThreadCap rv))
                                  \<and> (cap_get_tag rv' = scast cap_thread_cap \<longrightarrow> ccap_relation rv rv'))
                                (fst (extraCaps ! 0))"
                and xf'=tcap_' in ccorres_split_nothrow) apply (rule ccorres_from_vcg[where P="excaps_in_mem extraCaps \<circ> ctes_of" and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: excaps_in_mem_def return_def neq_Nil_conv) apply (drule(1) slotcap_in_mem_ThreadCap) apply (frule interpret_excaps_eq[rule_format, where n=0], simp) apply (clarsimp simp: typ_heap_simps' mask_def word_sless_def word_sle_def) apply ceqv apply csymbr apply clarsimp apply (rule ccorres_Cond_rhs_Seq) apply (simp add: Collect_const) apply (simp add: throwError_bind invocationCatch_def
                   cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: Collect_const returnOk_def uncurry_def) apply (simp (no_asm) add: ccorres_invocationCatch_Inr split_def
                                 performInvocation_def liftE_bindE bind_assoc) apply (ctac add: setThreadState_ccorres) apply csymbr apply (ctac add: setDomain_ccorres) apply (rule ccorres_alternative2) apply (ctac add: ccorres_return_CE) apply wp apply (vcg exspec=setDomain_modifies) apply (wp sts_invs_minor') apply (vcg exspec=setThreadState_modifies) apply wp apply simp apply clarsimp apply vcg apply wp apply simp apply clarsimp apply (vcg exspec=getSyscallArg_modifies) apply (clarsimp simp: valid_tcb_state'_def invs_valid_queues' invs_valid_objs'
                        invs_queues invs_sch_act_wf' ct_in_state'_def pred_tcb_at'
                        rf_sr_ksCurThread word_sle_def word_sless_def sysargs_rel_to_n
                        mask_eq_iff_w2p mask_eq_iff_w2p word_size "StrictC'_thread_state_defs") apply (rule conjI) apply (clarsimp simp: linorder_not_le isCap_simps) apply (rule conjI, clarsimp simp: unat32_eq_of_nat) apply clarsimp apply (drule_tac x="extraCaps ! 0" and P="\<lambda>v. valid_cap' (fst v) s" in bspec) apply (clarsimp simp: nth_mem interpret_excaps_test_null excaps_map_def) apply (clarsimp simp: valid_cap_simps' pred_tcb'_weakenE active_runnable') apply (rule conjI) apply (fastforce simp: tcb_st_refs_of'_def elim:pred_tcb'_weakenE) apply (simp add: word_le_nat_alt unat_ucast unat_numDomains_to_H le_maxDomain_eq_less_numDomains) apply (clarsimp simp: ccap_relation_def cap_to_H_simps cap_thread_cap_lift) subgoal  (* args ! 0 can be contained in a domain-sized word *)
     by (clarsimp simp: not_le unat_numDomains_to_H ucast_ucast_len[simplified word_less_nat_alt]
                 dest!: less_numDomains_is_domain) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>invLabel = lab\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeDomainInvocation lab args extraCaps >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (Call decodeDomainInvocation_'proc) proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>invLabel = lab\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeDomainInvocation lab args extraCaps >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (Call decodeDomainInvocation_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3101 buffera invLabel calla current_extra_caps length___unsigned_long) (?Q'3101 buffera invLabel calla current_extra_caps length___unsigned_long) [SKIP] (doE y <- if gen_invocation_type lab \<noteq> gen_invocation_labels.DomainSetSet then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (IF invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF length___unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  \<acute>domain :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI;;
(IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q3101 buffera invLabel calla current_extra_caps length___unsigned_long s \<and> s' \<in> ?Q'3101 buffera invLabel calla current_extra_caps length___unsigned_long proof (prove)
goal (3 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3107 buffera invLabel calla current_extra_caps length___unsigned_long) (?S3107 buffera invLabel calla current_extra_caps length___unsigned_long) [SKIP] (doE y <- if gen_invocation_type lab \<noteq> gen_invocation_labels.DomainSetSet then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF length___unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  \<acute>domain :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI;;
(IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; \<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3107 buffera invLabel calla current_extra_caps length___unsigned_long) (?T3107 buffera invLabel calla current_extra_caps length___unsigned_long) [SKIP] (doE y <- if gen_invocation_type lab \<noteq> gen_invocation_labels.DomainSetSet then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(IF length___unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  \<acute>domain :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI;;
(IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> ?Q3107 buffera invLabel calla current_extra_caps length___unsigned_long s) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> ?R3107 buffera invLabel calla current_extra_caps length___unsigned_long s)) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> ?S3107 buffera invLabel calla current_extra_caps length___unsigned_long) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> ?T3107 buffera invLabel calla current_extra_caps length___unsigned_long)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab \<noteq> gen_invocation_labels.DomainSetSet\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3107 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?S3107 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF length___unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument));;
\<acute>globals :== current_syscall_error_'_update (invalidArgumentNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument));;
\<acute>globals :== current_syscall_error_'_update (invalidArgumentNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; \<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3107 buffera invLabel calla current_extra_caps length___unsigned_long) (?T3107 buffera invLabel calla current_extra_caps length___unsigned_long) [SKIP] (doE y <- if gen_invocation_type lab \<noteq> gen_invocation_labels.DomainSetSet then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(IF length___unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  \<acute>domain :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI;;
(IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> ?Q3107 buffera invLabel calla current_extra_caps length___unsigned_long s) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> ?R3107 buffera invLabel calla current_extra_caps length___unsigned_long s)) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> ?S3107 buffera invLabel calla current_extra_caps length___unsigned_long) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> ?T3107 buffera invLabel calla current_extra_caps length___unsigned_long)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab \<noteq> gen_invocation_labels.DomainSetSet\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; \<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3107 buffera invLabel calla current_extra_caps length___unsigned_long) (?T3107 buffera invLabel calla current_extra_caps length___unsigned_long) [SKIP] (doE y <- if gen_invocation_type lab \<noteq> gen_invocation_labels.DomainSetSet then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(IF length___unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  \<acute>domain :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI;;
(IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> ?R3107 buffera invLabel calla current_extra_caps length___unsigned_long s)) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> ?T3107 buffera invLabel calla current_extra_caps length___unsigned_long)} proof (prove)
goal (2 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; \<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3107 buffera invLabel calla current_extra_caps length___unsigned_long) (?T3107 buffera invLabel calla current_extra_caps length___unsigned_long) [SKIP] (doE y <- if gen_invocation_type lab \<noteq> gen_invocation_labels.DomainSetSet then throwError Fault_H.syscall_error.IllegalOperation else returnOk ();
domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(IF length___unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  \<acute>domain :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI;;
(IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> ?R3107 buffera invLabel calla current_extra_caps length___unsigned_long s)) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> ?T3107 buffera invLabel calla current_extra_caps length___unsigned_long)} proof (prove)
goal (2 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3107 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?T3107 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (doE domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (IF length___unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> ?R3107 buffera invLabel calla current_extra_caps length___unsigned_long s)) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> ?T3107 buffera invLabel calla current_extra_caps length___unsigned_long)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; length___unsigned_long = 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3125 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?S3128 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (doE domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; length___unsigned_long \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3124 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?T3126 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (doE domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> ?Q3125 buffera invLabel calla current_extra_caps length___unsigned_long s) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> ?R3124 buffera invLabel calla current_extra_caps length___unsigned_long s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> ?S3128 buffera invLabel calla current_extra_caps length___unsigned_long) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> ?T3126 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; args = []; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; length___unsigned_long = 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3125 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' 0) (?S3128 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' 0) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument));;
\<acute>globals :== current_syscall_error_'_update (invalidArgumentNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; length___unsigned_long \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3124 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?T3126 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (doE domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> ?Q3125 buffera invLabel calla current_extra_caps length___unsigned_long s) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> ?R3124 buffera invLabel calla current_extra_caps length___unsigned_long s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> ?S3128 buffera invLabel calla current_extra_caps length___unsigned_long) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> ?T3126 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; args = []; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; length___unsigned_long = 0\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; length___unsigned_long \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3124 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?T3126 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (doE domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> ?R3124 buffera invLabel calla current_extra_caps length___unsigned_long s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> ?T3126 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; length___unsigned_long \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3124 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?T3126 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (doE domain <- if args = [] then throw Fault_H.syscall_error.TruncatedMessage else doE whenE (numDomains \<le> fromIntegral (hd args)) $ throw (Fault_H.syscall_error.InvalidArgument 0);
returnOk $ fromIntegral (hd args)
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> ?R3124 buffera invLabel calla current_extra_caps length___unsigned_long s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> ?T3126 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3124 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?T3126 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (hd args)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (hd args))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> ?R3124 buffera invLabel calla current_extra_caps length___unsigned_long s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> ?T3126 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3124 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?T3126 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (do _ <- return ();
doE domain <- doE y <- whenE (numDomains \<le> unat (hd args)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (hd args))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)
od) (\<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> ?R3124 buffera invLabel calla current_extra_caps length___unsigned_long s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> ?T3126 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3124 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) (?T3126 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) [SKIP] (do _ <- return ();
doE domain <- doE y <- whenE (numDomains \<le> unat (hd args)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (hd args))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)
od) (\<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> \<acute>domain THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>domain);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> ?R3124 buffera invLabel calla current_extra_caps length___unsigned_long s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> ?T3126 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long rv domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3154 buffera invLabel calla current_extra_caps length___unsigned_long rv) (?Q'3154 buffera invLabel calla current_extra_caps length___unsigned_long rv domain___unsigned_long) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (hd args)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (hd args))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (IF SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains \<le> domain___unsigned_long THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,domain___unsigned_long);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>?Q3154 buffera invLabel calla current_extra_caps length___unsigned_long\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3154 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s)}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3154 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?Q'3154 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (args ! 0)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (args ! 0))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (IF unat (SCAST(32 signed \<rightarrow> 32) Kernel_C.numDomains) \<le> unat (args ! 0) THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>?Q3154 buffera invLabel calla current_extra_caps length___unsigned_long\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3154 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s)}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3154 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?Q'3154 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (args ! 0)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (args ! 0))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (IF unat Kernel_C.numDomains \<le> unat (args ! 0) THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>?Q3154 buffera invLabel calla current_extra_caps length___unsigned_long\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3154 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s)}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; unat Kernel_C.numDomains \<le> unat (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3530 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?S3533 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (args ! 0)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (args ! 0))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> unat Kernel_C.numDomains \<le> unat (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3529 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3531 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (args ! 0)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (args ! 0))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> ?Q3530 buffera invLabel calla current_extra_caps length___unsigned_long a b) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> ?R3529 buffera invLabel calla current_extra_caps length___unsigned_long a b)\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> ?S3533 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s)) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> ?T3531 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; numDomains \<le> unat (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3530 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?S3533 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (throwError (Inl (Fault_H.syscall_error.InvalidArgument 0))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument));;
\<acute>globals :== current_syscall_error_'_update (invalidArgumentNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument));;
\<acute>globals :== current_syscall_error_'_update (invalidArgumentNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> unat Kernel_C.numDomains \<le> unat (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3529 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3531 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (args ! 0)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (args ! 0))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> ?Q3530 buffera invLabel calla current_extra_caps length___unsigned_long a b) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> ?R3529 buffera invLabel calla current_extra_caps length___unsigned_long a b)\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> ?S3533 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s)) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> ?T3531 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; numDomains \<le> unat (args ! 0)\<rbrakk> \<Longrightarrow> syscall_error_to_H (invalidArgumentNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) err')) ft' = Some (Fault_H.syscall_error.InvalidArgument 0)
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> unat Kernel_C.numDomains \<le> unat (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3529 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3531 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (args ! 0)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (args ! 0))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> ?R3529 buffera invLabel calla current_extra_caps length___unsigned_long a b)\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> ?T3531 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> unat Kernel_C.numDomains \<le> unat (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3529 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3531 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE domain <- doE y <- whenE (numDomains \<le> unat (args ! 0)) (throwError (Fault_H.syscall_error.InvalidArgument 0));
returnOk (UCAST(32 \<rightarrow> 8) (args ! 0))
odE;
y <- if null extraCaps then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, domain) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> ?R3529 buffera invLabel calla current_extra_caps length___unsigned_long a b)\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> ?T3531 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3529 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3531 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE y <- if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, UCAST(32 \<rightarrow> 8) (args ! 0)) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> ?R3529 buffera invLabel calla current_extra_caps length___unsigned_long a b)\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> ?T3531 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); excaprefs_C extraCaps'.[0] = NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?S3554 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE y <- if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, UCAST(32 \<rightarrow> 8) (args ! 0)) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); excaprefs_C extraCaps'.[0] \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3550 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3552 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE y <- if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, UCAST(32 \<rightarrow> 8) (args ! 0)) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> ?Q3551 buffera invLabel calla current_extra_caps length___unsigned_long a b) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> ?R3550 buffera invLabel calla current_extra_caps length___unsigned_long a b))\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> ?S3554 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s)) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> ?T3552 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = []; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?S3554 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument));;
\<acute>globals :== current_syscall_error_'_update (invalidArgumentNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); excaprefs_C extraCaps'.[0] \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3550 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3552 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE y <- if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, UCAST(32 \<rightarrow> 8) (args ! 0)) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> ?Q3551 buffera invLabel calla current_extra_caps length___unsigned_long a b) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> ?R3550 buffera invLabel calla current_extra_caps length___unsigned_long a b))\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> ?S3554 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s)) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> ?T3552 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long err' ft'. \<lbrakk>interpret_excaps extraCaps' = []; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); excaprefs_C extraCaps'.[0] \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3550 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3552 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE y <- if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, UCAST(32 \<rightarrow> 8) (args ! 0)) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> ?R3550 buffera invLabel calla current_extra_caps length___unsigned_long a b))\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> ?T3552 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); excaprefs_C extraCaps'.[0] \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3550 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3552 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (doE y <- if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else returnOk ();
case fst (hd extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk $ (ptr, UCAST(32 \<rightarrow> 8) (args ! 0)) | _ \<Rightarrow> throw (Fault_H.syscall_error.InvalidArgument 1)
odE >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> ?R3550 buffera invLabel calla current_extra_caps length___unsigned_long a b))\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> ?T3552 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3550 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3552 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> ?R3550 buffera invLabel calla current_extra_caps length___unsigned_long a b))\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> ?T3552 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3550 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?T3552 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (do _ <- return ();
(if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> ?R3550 buffera invLabel calla current_extra_caps length___unsigned_long a b))\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> ?T3552 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv'. (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')) tcap_' (?P3583 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()) (?P'3576 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) [SKIP] (return ()) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ceqv \<Gamma> tcap_' rv' t t' (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv') [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> ?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s)}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (?P3583 buffera invLabel calla current_extra_caps length___unsigned_long a and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> ?P'3576 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s) \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (excaps_in_mem extraCaps \<circ> ctes_of) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s))}
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ceqv \<Gamma> tcap_' rv' t t' (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv') [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> ?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s)}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> {s. (excaps_in_mem extraCaps \<circ> ctes_of) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0] \<and> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', tcap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) s) \<in> rf_sr \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])))))}
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ceqv \<Gamma> tcap_' rv' t t' (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv') [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> ?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s)}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long \<sigma> x y a ys b ysa. \<lbrakk>interpret_excaps extraCaps' = cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = Suc (length ys); gen_invocation_type lab = gen_invocation_labels.DomainSetSet; \<not> numDomains \<le> unat y; args = y # ys; extraCaps = (a, b) # ysa; (\<sigma>, x) \<in> rf_sr; slotcap_in_mem a b (ctes_of \<sigma>); \<forall>x\<in>set ysa. case x of (cp, slot) \<Rightarrow> slotcap_in_mem cp slot (ctes_of \<sigma>)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap a \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation a (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ceqv \<Gamma> tcap_' rv' t t' (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv') [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> ?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s)}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long \<sigma> x y a ys b ysa. \<lbrakk>interpret_excaps extraCaps' = cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = Suc (length ys); gen_invocation_type lab = gen_invocation_labels.DomainSetSet; \<not> numDomains \<le> unat y; args = y # ys; extraCaps = (a, b) # ysa; (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>set ysa. case x of (cp, slot) \<Rightarrow> slotcap_in_mem cp slot (ctes_of \<sigma>); \<exists>v. cslift x (cte_Ptr b) = Some v \<and> (cap_get_tag (cte_C.cap_C v) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap a \<and> (isThreadCap a \<longrightarrow> ccap_relation a (cte_C.cap_C v))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap a \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation a (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ceqv \<Gamma> tcap_' rv' t t' (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv') [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> ?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s)}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long \<sigma> x y a ys b ysa. \<lbrakk>interpret_excaps extraCaps' = cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = Suc (length ys); gen_invocation_type lab = gen_invocation_labels.DomainSetSet; \<not> numDomains \<le> unat y; args = y # ys; extraCaps = (a, b) # ysa; (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>set ysa. case x of (cp, slot) \<Rightarrow> slotcap_in_mem cp slot (ctes_of \<sigma>); \<exists>v. cslift x (cte_Ptr b) = Some v \<and> (cap_get_tag (cte_C.cap_C v) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap a \<and> (isThreadCap a \<longrightarrow> ccap_relation a (cte_C.cap_C v)); excaprefs_C extraCaps'.[0] = (cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ysa) ! 0 \<and> (length (cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ysa) < 3 \<longrightarrow> excaprefs_C extraCaps'.[length (cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ysa)] = NULL)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap a \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation a (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ceqv \<Gamma> tcap_' rv' t t' (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv') [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> ?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s)}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (7 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv' t t'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ceqv \<Gamma> tcap_' rv' t t' (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>tcap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>tcap);;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv') [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (?d'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv')
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> ?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s)}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (6 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv') [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(rv');;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> ?Q'3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s)}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (6 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv' ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv'); ret__unsigned = cap_get_tag rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv) (?G'3837 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv rv' ret__unsigned) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3837 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)); isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3572 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?G'3837 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (IF \<not> isThreadCap (fst (extraCaps ! 0)) THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>?Q3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3837 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)); isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv'; \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4008 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?S4010 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)); isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv'; \<not> \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4007 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?T4009 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?Q4008 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?R4007 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b)\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?S4010 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?T4009 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap; \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4008 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?S4010 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidArgumentNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)); isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv'; \<not> \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4007 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?T4009 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?Q4008 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?R4007 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b)\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?S4010 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?T4009 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap; \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4008 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?S4010 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] (throwError (Inl (Fault_H.syscall_error.InvalidArgument (Suc 0)))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument));;
\<acute>globals :== current_syscall_error_'_update (invalidArgumentNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)); isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv'; \<not> \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4007 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?T4009 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?Q4008 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?R4007 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b)\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?S4010 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?T4009 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long rv' err' ft'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap; \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> syscall_error_to_H (invalidArgumentNumber_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument) err')) ft' = Some (Fault_H.syscall_error.InvalidArgument (Suc 0))
 2. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)); isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv'; \<not> \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4007 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?T4009 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?R4007 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b)\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?T4009 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; (cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)); isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) rv'; \<not> \<not> isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4007 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?T4009 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (cap_get_tag rv')) [SKIP] ((if isThreadCap (fst (extraCaps ! 0)) then returnOk $ (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)) else throw (Fault_H.syscall_error.InvalidArgument 1)) >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?R4007 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b)\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?T4009 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4007 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?T4009 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) [SKIP] (invocationCatch thread isBlocking isCall (\<lambda>(x, y). Invocations_H.invocation.InvokeDomain x y) (Inr (capTCBPtr (fst (extraCaps ! 0)), UCAST(32 \<rightarrow> 8) (args ! 0)))) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?R4007 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b)\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?T4009 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4007 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()) (?T4009 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
y <- setDomain (capTCBPtr (fst (extraCaps ! 0))) (UCAST(32 \<rightarrow> 8) (args ! 0));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ?R4007 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a b)\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> ?T4009 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long rv' rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4027 length___unsigned_long rv' rv) (?Q'4027 length___unsigned_long rv' rv xfdc) [SKIP] (do y <- setDomain (capTCBPtr (fst (extraCaps ! 0))) (UCAST(32 \<rightarrow> 8) (args ! 0));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(rv');;
(CALL setDomain_'proc(tcb_Ptr \<acute>ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4033 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4027 length___unsigned_long rv'\<rbrace>
 3. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4028 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4027 length___unsigned_long rv' rv (xfdc s)}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4033 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a) b)\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4028 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long rv' rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv')\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4027 length___unsigned_long rv' rv) (?G'4072 length___unsigned_long rv' rv xfdc ret__unsigned) [SKIP] (do y <- setDomain (capTCBPtr (fst (extraCaps ! 0))) (UCAST(32 \<rightarrow> 8) (args ! 0));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (CALL setDomain_'proc(tcb_Ptr ret__unsigned,args ! 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4033 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4027 length___unsigned_long rv'\<rbrace>
 3. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4028 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. rv') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'4072 length___unsigned_long rv' rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. rv') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4033 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a) b)\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4028 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long rv' rv xfdca ret__unsigned rva xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdca; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv'); dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4140 length___unsigned_long rv' rv xfdca ret__unsigned rva) (?Q'4140 length___unsigned_long rv' rv xfdca ret__unsigned rva xfdc) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>length___unsigned_long rv' rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R4142 length___unsigned_long rv' rv\<rbrace> setDomain (capTCBPtr (fst (extraCaps ! 0))) (UCAST(32 \<rightarrow> 8) (args ! 0)) \<lbrace>?Q4140 length___unsigned_long rv' rv xfdc ret__unsigned\<rbrace>
 3. \<And>length___unsigned_long rv' rv xfdca ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdca; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4140 length___unsigned_long rv' rv xfdca ret__unsigned) CALL setDomain_'proc(tcb_Ptr ret__unsigned,args ! 0) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'4140 length___unsigned_long rv' rv xfdca ret__unsigned rva (xfdc s)}
 4. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4033 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and sch_act_simple and (\<lambda>s. UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain) and ?R4142 length___unsigned_long rv' a\<rbrace>
 5. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4028 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. rv') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. dom_'_update (\<lambda>_. args ! 0) (tptr_'_update (\<lambda>_. tcb_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace> \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))\<rbrace>} \<inter> ?R'4140 length___unsigned_long rv' rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. rv') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4033 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a) b)\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4028 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 9. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 10. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long rv' rv xfdca ret__unsigned rva xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdca; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv'); dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4140 length___unsigned_long rv' rv xfdca ret__unsigned rva) (?Q'4140 length___unsigned_long rv' rv xfdca ret__unsigned rva xfdc) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>length___unsigned_long rv' rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R4142 length___unsigned_long rv' rv\<rbrace> setDomain (capTCBPtr (fst (extraCaps ! 0))) (UCAST(32 \<rightarrow> 8) (args ! 0)) \<lbrace>?Q4140 length___unsigned_long rv' rv xfdc ret__unsigned\<rbrace>
 3. \<And>length___unsigned_long rv' rv xfdca ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdca; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4140 length___unsigned_long rv' rv xfdca ret__unsigned) CALL setDomain_'proc(tcb_Ptr ret__unsigned,args ! 0) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'4140 length___unsigned_long rv' rv xfdca ret__unsigned rva (xfdc s)}
 4. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4033 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and sch_act_simple and (\<lambda>s. UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain) and ?R4142 length___unsigned_long rv' a\<rbrace>
 5. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4028 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. rv') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. dom_'_update (\<lambda>_. args ! 0) (tptr_'_update (\<lambda>_. tcb_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace> \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))\<rbrace>} \<inter> ?R'4140 length___unsigned_long rv' rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. rv') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4033 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a) b)\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4028 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 9. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 10. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long rv' rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv')\<rbrakk> \<Longrightarrow> \<lbrace>?R4142 length___unsigned_long rv' rv\<rbrace> setDomain (capTCBPtr (fst (extraCaps ! 0))) (UCAST(32 \<rightarrow> 8) (args ! 0)) \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>length___unsigned_long rv' rv xfdca ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdca; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4140 length___unsigned_long rv' rv xfdca ret__unsigned) CALL setDomain_'proc(tcb_Ptr ret__unsigned,args ! 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}
 3. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4033 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and sch_act_simple and (\<lambda>s. UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain) and ?R4142 length___unsigned_long rv' a\<rbrace>
 4. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4028 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. rv') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. dom_'_update (\<lambda>_. args ! 0) (tptr_'_update (\<lambda>_. tcb_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace> \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))\<rbrace>} \<inter> ?R'4140 length___unsigned_long rv' rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. rv') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4033 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a) b)\<rbrace>
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4028 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 9. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long rv' rv xfdca ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0)); dc rv xfdca; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4140 length___unsigned_long rv' rv xfdca ret__unsigned) CALL setDomain_'proc(tcb_Ptr ret__unsigned,args ! 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}
 2. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4033 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and sch_act_simple and (\<lambda>s. UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain) and (\<lambda>_. True)\<rbrace>
 3. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4028 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. rv') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. dom_'_update (\<lambda>_. args ! 0) (tptr_'_update (\<lambda>_. tcb_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace> \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))\<rbrace>} \<inter> ?R'4140 length___unsigned_long rv' rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. rv') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4033 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a) b)\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4028 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 8. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4033 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and sch_act_simple and (\<lambda>s. UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain) and (\<lambda>_. True)\<rbrace>
 2. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4028 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. dom_'_update (\<lambda>_. args ! 0) (tptr_'_update (\<lambda>_. tcb_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace> \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. rv') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4033 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long a) b)\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4028 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 7. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long rv'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; cap_get_tag rv' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ccap_relation (fst (extraCaps ! 0)) rv'; isThreadCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4028 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0) () rv' (SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. rv') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. dom_'_update (\<lambda>_. args ! 0) (tptr_'_update (\<lambda>_. tcb_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace> \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. rv') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) domain___unsigned_long \<le> maxDomain \<and> True)) b)\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4028 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long rv (tcap_' s) v)}}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 6. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long ()\<rbrace> return () \<lbrace>\<lambda>a b. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) domain___unsigned_long \<le> maxDomain \<and> True)) b)\<rbrace>
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rva. dc rva (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (tcap_' s))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> domain___unsigned_long = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) domain___unsigned_long) \<and> (\<forall>t rva. dc rva (xfdc (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (tcap_' s)), globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) \<and> cap_get_tag (tcap_' s) = v})}}}
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (5 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []; ?R3581 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () s\<rbrakk> \<Longrightarrow> (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) domain___unsigned_long \<le> maxDomain \<and> True)) s)
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rva. dc rva (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (tcap_' s))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> domain___unsigned_long = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) domain___unsigned_long) \<and> (\<forall>t rva. dc rva (xfdc (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (tcap_' s)), globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) \<and> cap_get_tag (tcap_' s) = v})}}}
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and ?R3581 buffera invLabel calla current_extra_caps length___unsigned_long a) b))\<rbrace>
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 5. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; domain___unsigned_long = args ! 0; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 buffera invLabel calla current_extra_caps length___unsigned_long domain___unsigned_long\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) {s. \<forall>rv. (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (tcap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (tcap_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. tcap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rva. dc rva (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (tcap_' s))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> domain___unsigned_long = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) domain___unsigned_long) \<and> (\<forall>t rva. dc rva (xfdc (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (tcap_' s)), globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) \<and> cap_get_tag (tcap_' s) = v})}}}
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>a. isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain)) b))\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; \<not> numDomains \<le> unat (args ! 0); extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3572 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long (args ! 0)\<^esub> (?R'3575 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long () (args ! 0)) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>tcap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<lbrace>(cap_get_tag \<acute>tcap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag \<acute>tcap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) \<acute>tcap) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift \<acute>tcap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))\<rbrace>
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>a. isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain)) b))\<rbrace>
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> ?R'3575 buffera invLabel calla current_extra_caps length___unsigned_long rv (domain_' s))})}}
 4. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long\<rbrace> return () \<lbrace>\<lambda>a b. (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>a. isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain)) b))\<rbrace>
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> {sa. sa \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> domain_' s = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (domain_' s))})})}}
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (3 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []; ?R3162 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long s\<rbrakk> \<Longrightarrow> (unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> True) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> True) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> (excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>a. isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain)) s))
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> {sa. sa \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> domain_' s = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (domain_' s))})})}}
 3. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3162 buffera invLabel calla current_extra_caps length___unsigned_long) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (2 subgoals):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. domain_' s = args ! 0 \<longrightarrow> s \<in> {sa. (unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> UNIV) \<and> (\<not> unat Kernel_C.numDomains \<le> unat (domain_' s) \<longrightarrow> sa \<in> {sa. (excaprefs_C current_extra_caps.[0] = NULL \<longrightarrow> sa \<in> UNIV) \<and> (excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> sa \<in> UNIV \<inter> {sa. sa \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> domain_' s = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (domain_' s))})})}}
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (\<lambda>a. \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> excaps_in_mem extraCaps (ctes_of a) \<and> (isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain))) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; gen_invocation_type lab = gen_invocation_labels.DomainSetSet; args \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3155 (option_to_ptr buffer) lab (from_bool isCall) extraCaps' length___unsigned_long) \<acute>domain :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. domain_' s = args ! 0 \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C extraCaps'.[0] \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))}
 2. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (\<lambda>a. \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> excaps_in_mem extraCaps (ctes_of a) \<and> (isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain))) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3155 buffera invLabel calla current_extra_caps length___unsigned_long)})} proof (prove)
goal (1 subgoal):
 1. \<And>buffera invLabel calla current_extra_caps length___unsigned_long s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; invLabel = lab; calla = from_bool isCall; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> True) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> (length___unsigned_long = 0 \<longrightarrow> True) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (\<lambda>a. \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> excaps_in_mem extraCaps (ctes_of a) \<and> (isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> sch_act_simple a \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain))) s))) \<and> s' \<in> {s. (invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> UNIV) \<and> (\<not> invLabel \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> s \<in> {s. (length___unsigned_long = 0 \<longrightarrow> s \<in> UNIV) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t = args ! 0 \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C current_extra_caps.[0] \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))})})} proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> args \<noteq> [] \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) s \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain)) \<and> (lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> args \<noteq> [] \<and> (\<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) s \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain)
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0\<rbrakk> \<Longrightarrow> args \<noteq> [] \<and> (unat (args ! 0) < unat Kernel_C.numDomains \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> (\<exists>v0. fst (extraCaps ! 0) = capability.ThreadCap v0) \<longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) s \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain)
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0\<rbrakk> \<Longrightarrow> unat (args ! 0) < unat Kernel_C.numDomains \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> (\<exists>v0. fst (extraCaps ! 0) = capability.ThreadCap v0) \<longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) s \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; unat (args ! 0) < unat Kernel_C.numDomains; excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; fst (extraCaps ! 0) = capability.ThreadCap v0\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' v0 s \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long s s' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; unat (args ! 0) < unat Kernel_C.numDomains; excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; fst (extraCaps ! 0) = capability.ThreadCap v0\<rbrakk> \<Longrightarrow> extraCaps ! 0 \<in> set extraCaps
 2. \<And>length___unsigned_long s s' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; unat (args ! 0) < unat Kernel_C.numDomains; excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; fst (extraCaps ! 0) = capability.ThreadCap v0; valid_cap' (fst (extraCaps ! 0)) s\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' v0 s \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain
 3. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; unat (args ! 0) < unat Kernel_C.numDomains; excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; fst (extraCaps ! 0) = capability.ThreadCap v0; valid_cap' (fst (extraCaps ! 0)) s\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' v0 s \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; unat (args ! 0) < unat Kernel_C.numDomains; excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; fst (extraCaps ! 0) = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long s s' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; unat (args ! 0) < unat Kernel_C.numDomains; excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; fst (extraCaps ! 0) = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s\<rbrakk> \<Longrightarrow> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s
 2. \<And>length___unsigned_long s s' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; unat (args ! 0) < unat Kernel_C.numDomains; excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; fst (extraCaps ! 0) = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain
 3. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s' v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; unat (args ! 0) < unat Kernel_C.numDomains; excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; fst (extraCaps ! 0) = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 8) (args ! 0) \<le> maxDomain
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet \<longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> \<not> unat Kernel_C.numDomains \<le> unat (args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0] \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) = isThreadCap (fst (extraCaps ! 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<and> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s' t. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; st_tcb_at' active' (ksCurThread s) s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long \<noteq> 0; ret__unsigned_long_' t = args ! 0; \<not> unat Kernel_C.numDomains \<le> unat (args ! 0); excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL; s' \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s')).[0]; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))))))); cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = Some (Cap_thread_cap (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C''])))))))\<rbrakk> \<Longrightarrow> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s'_)) = excaps_map extraCaps; unat length___unsigned_long_ = length args; (s_, s'_) \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'_); invs' s_; thread = ksCurThread s_; sch_act_simple s_; st_tcb_at' active' (ksCurThread s_) s_; excaps_in_mem extraCaps (ctes_of s_); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s_; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s_; sysargs_rel args buffer s_; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long_ \<noteq> 0; ret__unsigned_long_' t_ = args ! 0; \<not> unat Kernel_C.numDomains \<le> unat (args ! 0); excaprefs_C (current_extra_caps_' (globals s'_)).[0] \<noteq> NULL; s'_ \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s'_)).[0]; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'_))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s'_)).[0]\<rightarrow>[''cap_C''])))))))); cap_lift (h_val (hrs_mem (t_hrs_' (globals s'_))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s'_)).[0]\<rightarrow>[''cap_C'']))) = Some (Cap_thread_cap (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'_))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s'_)).[0]\<rightarrow>[''cap_C'']))))); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'_))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s'_)).[0]\<rightarrow>[''cap_C''])))))))\<rbrakk> \<Longrightarrow> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s'_)) = excaps_map extraCaps; unat length___unsigned_long_ = length args; (s_, s'_) \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'_); invs' s_; thread = ksCurThread s_; sch_act_simple s_; st_tcb_at' active' (ksCurThread s_) s_; excaps_in_mem extraCaps (ctes_of s_); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s_; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s_; sysargs_rel args buffer s_; lab = SCAST(32 signed \<rightarrow> 32) Kernel_C.DomainSetSet; length___unsigned_long_ \<noteq> 0; ret__unsigned_long_' t_ = args ! 0; \<not> unat Kernel_C.numDomains \<le> unat (args ! 0); excaprefs_C (current_extra_caps_' (globals s'_)).[0] \<noteq> NULL; s'_ \<Turnstile>\<^sub>c excaprefs_C (current_extra_caps_' (globals s'_)).[0]; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'_))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s'_)).[0]\<rightarrow>[''cap_C''])))))))); cap_lift (h_val (hrs_mem (t_hrs_' (globals s'_))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s'_)).[0]\<rightarrow>[''cap_C'']))) = Some (Cap_thread_cap (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'_))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s'_)).[0]\<rightarrow>[''cap_C'']))))); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'_))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s'_)).[0]\<rightarrow>[''cap_C''])))))))\<rbrakk> \<Longrightarrow> args ! 0 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (args ! 0)) proof (prove)
goal:
No subgoals!