theory Tcb_DR

lemma decode_tcb_corres:
  "\<lbrakk> Some (TcbIntent ui) = transform_intent (invocation_type label') args';
     cap = transform_cap cap';
     cap' = Structures_A.ThreadCap t;
     slot = transform_cslot_ptr slot';
     excaps = transform_cap_list excaps' \<rbrakk> \<Longrightarrow>
   dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) \<top> \<top>
     (Tcb_D.decode_tcb_invocation cap slot excaps ui)
     (Decode_A.decode_tcb_invocation label' args' cap' slot' excaps')" supply if_cong[cong] apply (unfold Tcb_D.decode_tcb_invocation_def Decode_A.decode_tcb_invocation_def) apply (drule sym, frule transform_tcb_intent_invocation) apply (unfold transform_cap_def) apply (unfold transform_cap_list_def) apply (case_labels "invocation_type label'") apply (simp_all add: gen_invocation_type_eq) 
                (* TCBReadRegisters *)
                 apply (clarsimp simp: decode_read_registers_def split: list.split) apply (intro conjI impI allI) apply (auto)[2] apply (unfold bindE_def)[1] apply (rule corres_symb_exec_r[where Q'="\<lambda> rv s. True"]) apply (case_tac rv) apply (simp add: lift_def) apply (rule corres_alternate2, simp) apply (simp add: lift_def) apply (simp add: liftE_def lift_def) apply (rule corres_symb_exec_r[where Q'="\<lambda> rv s. True"]) apply (fold bindE_def) apply (rule dcorres_whenE_throwError_abstract') apply (rule corres_alternate2) apply simp apply (rule corres_alternate1) apply (clarsimp simp: returnOk_def translate_tcb_invocation_def) apply wp+ apply (simp add: range_check_def unlessE_def[abs_def]) 
               (* TCBWriteRegisters *)
                apply (clarsimp simp: decode_write_registers_def split: list.split) apply (intro impI conjI allI) 
                 (* IRQSetMode *)
                  apply (clarsimp simp: transform_intent_def) apply fastforce apply clarsimp apply (rule dcorres_whenE_throwError_abstract') apply (fastforce intro: corres_alternate2 simp: throwError_def) apply (simp add: liftE_def bindE_def lift_def) apply (rule corres_symb_exec_r[where Q'="\<lambda> rv s. True"]) apply (fold bindE_def, rule dcorres_whenE_throwError_abstract') apply (fastforce intro: corres_alternate2 simp: throwError_def) apply (fastforce intro: corres_alternate1
                                    simp: returnOk_def
                                          translate_tcb_invocation_def) apply wp+ 
              (* TCBCopyRegisters *)
               apply (clarsimp simp: decode_copy_registers_def) apply (case_tac args') apply (clarsimp simp:whenE_def dcorres_alternative_throw split:option.splits)+ apply (case_tac "map fst excaps'") apply (clarsimp simp: dcorres_alternative_throw split:option.splits)+ apply (case_tac ab) apply (clarsimp simp:throw_on_none_def get_index_def dcorres_alternative_throw split:option.splits)+ apply (rule corres_alternate1) apply (clarsimp simp:returnOk_def corres_underlying_def translate_tcb_invocation_def return_def) apply ((clarsimp simp:throw_on_none_def get_index_def dcorres_alternative_throw split:option.splits)+)[5] 
             (* TCBConfigures *)
              apply (clarsimp simp: decode_tcb_configure_def dcorres_alternative_throw whenE_def) apply (case_tac "excaps' ! 2") apply (case_tac "excaps' ! Suc 0") apply (case_tac "excaps' ! 0") apply (rule split_return_throw_thingy) apply (rule_tac a = a and b = b and c = c in decode_set_ipc_buffer_translate_tcb_invocation) apply simp+ apply (rule split_return_throw_thingy) apply (rule decode_set_space_translate_tcb_invocation) apply (clarsimp simp: get_index_def throw_on_none_def) apply (rule conjI | clarsimp)+ apply (rule corres_alternate1,rule dcorres_returnOk) apply (clarsimp simp: translate_tcb_invocation_def update_cnode_cap_data) apply clarsimp apply (clarsimp | rule conjI)+ apply (rule corres_alternate1,rule dcorres_returnOk) apply (clarsimp simp: translate_tcb_invocation_def update_cnode_cap_data) apply clarsimp+ 
            (* TCBSetPriority *)
             apply (clarsimp simp: decode_set_priority_def throw_on_none_def get_index_def dcorres_alternative_throw whenE_def) apply (case_tac "fst (excaps' ! 0)"; simp add: dcorres_alternative_throw) apply (rule corres_throw_skip_r) apply (rule corres_alternate1) apply (rule dcorres_returnOk) apply (clarsimp simp: translate_tcb_invocation_def translate_tcb_invocation_thread_ctrl_buffer_def) apply (rule check_prio_inv) apply fastforce 
           (* TCBSetMCPriority *)
            apply (clarsimp simp: decode_set_mcpriority_def throw_on_none_def get_index_def dcorres_alternative_throw whenE_def) apply (case_tac "fst (excaps' ! 0)"; simp add: dcorres_alternative_throw) apply (rule corres_throw_skip_r) apply (rule corres_alternate1) apply (rule dcorres_returnOk) apply (clarsimp simp: translate_tcb_invocation_def translate_tcb_invocation_thread_ctrl_buffer_def) apply (rule check_prio_inv) apply fastforce 
          (* TCBSetSchedParams *)
           apply (clarsimp simp: decode_set_sched_params_def throw_on_none_def get_index_def dcorres_alternative_throw whenE_def) apply (case_tac "fst (excaps' ! 0)"; simp add: dcorres_alternative_throw) apply (rule corres_throw_skip_r)+ apply (rule corres_alternate1) apply (rule dcorres_returnOk) apply (clarsimp simp: translate_tcb_invocation_def translate_tcb_invocation_thread_ctrl_buffer_def) apply (rule check_prio_inv) apply fastforce apply (rule check_prio_inv) apply fastforce 

         (* TCBSetIPCBuffer *)
          apply (clarsimp simp:transform_intent_def transform_intent_tcb_set_ipc_buffer_def) apply (case_tac args') apply clarsimp+ apply (case_tac "excaps' ! 0") apply (clarsimp simp:throw_on_none_def get_index_def dcorres_alternative_throw | rule conjI)+ apply (rule corres_return_throw_thingy) apply (rule decode_set_ipc_buffer_translate_tcb_invocation) apply fastforce+ apply (clarsimp|rule conjI)+ apply (clarsimp simp:translate_tcb_invocation_def translate_tcb_invocation_thread_ctrl_buffer_def
                           split:option.splits tcb_invocation.splits) apply (clarsimp simp:decode_set_ipc_buffer_def dcorres_alternative_throw)+ apply (rule corres_alternate1[OF dcorres_returnOk]) apply (clarsimp simp:translate_tcb_invocation_def translate_tcb_invocation_thread_ctrl_buffer_def) 
         (* TCBSetSpace *)
          apply (clarsimp simp:throw_on_none_def get_index_def dcorres_alternative_throw | rule conjI)+ apply (rule corres_return_throw_thingy) apply (rule decode_set_space_translate_tcb_invocation) apply (clarsimp split del: if_split)+ apply (clarsimp simp:translate_tcb_invocation_def translate_tcb_invocation_thread_ctrl_buffer_def) apply (case_tac "excaps' ! 0",simp,case_tac "excaps' ! Suc 0",simp) apply (simp add:update_cnode_cap_data) apply (simp add:decode_set_space_def dcorres_alternative_throw | rule conjI)+ 

       (* TCBSuspend *)
        apply clarsimp apply (rule corres_alternate1[OF dcorres_returnOk]) apply (simp add: translate_tcb_invocation_def) 

      (* TCBResume *)
       apply clarsimp apply (rule corres_alternate1[OF dcorres_returnOk]) apply (simp add: translate_tcb_invocation_def) 

     (* TCBBindNotification *)
      apply (clarsimp simp: decode_bind_notification_def dcorres_alternative_throw whenE_def) apply (rule dcorres_symb_exec_rE) apply (case_tac rv, simp) 
        (* please continue scrolling *)
         apply (case_tac "(fst (hd excaps'))", simp_all split del: if_split)[1] prefer 4 apply (rename_tac rights) apply (case_tac "AllowRead \<notin> rights", simp) apply (rule corres_alternate2, rule dcorres_throw) apply simp apply (rule dcorres_symb_exec_rE) apply (case_tac "ntfn_obj rva", simp_all split del: if_split)[1] apply (case_tac "ntfn_bound_tcb rva", simp_all split del: if_split)[1] apply (clarsimp simp: throw_on_none_def get_index_def dcorres_alternative_throw) apply (case_tac "excaps' ! 0", clarsimp, rule corres_alternate1[OF dcorres_returnOk], simp add: translate_tcb_invocation_def hd_conv_nth) apply (clarsimp simp: throw_on_none_def get_index_def dcorres_alternative_throw split del: if_split)+ apply (case_tac "ntfn_bound_tcb rva", simp split del: if_split)[1] apply (rename_tac rva word) apply ((case_tac "excaps' ! 0",clarsimp, rule corres_alternate1[OF dcorres_returnOk], simp add: translate_tcb_invocation_def hd_conv_nth)
                               | clarsimp simp: throw_on_none_def get_index_def dcorres_alternative_throw split del: if_split
                               | wp get_simple_ko_wp
                               | (case_tac "excaps' ! 0", rule dcorres_alternative_throw)
                               | (case_tac "AllowRead \<in> rights", simp))+ 

    (* TCBUnbindNotification *)
     apply (clarsimp simp: decode_unbind_notification_def dcorres_alternative_throw whenE_def) apply (rule dcorres_symb_exec_rE) apply (case_tac rv, simp, rule dcorres_alternative_throw) apply (clarsimp, rule corres_alternate1[OF dcorres_returnOk], simp add: translate_tcb_invocation_def) apply (wp gbn_wp | clarsimp)+ 

    (* TCBSetTLSBase *)
     apply (clarsimp simp: decode_set_tls_base_def whenE_def) apply (rule conjI; clarsimp) apply (rule dcorres_alternative_throw) apply (rule corres_alternate1[OF dcorres_returnOk]) apply (simp add: translate_tcb_invocation_def) 

  (* ARMASIDPoolAssign *)
   apply (clarsimp simp: transform_intent_def) 

  (* ARMIRQIssueIRQHandler *)
   apply (clarsimp simp: transform_intent_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (TcbIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (Tcb_D.decode_tcb_invocation cap slot excaps ui) (Decode_A.decode_tcb_invocation label' args' cap' slot' excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (TcbIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (Tcb_D.decode_tcb_invocation cap slot excaps ui) (Decode_A.decode_tcb_invocation label' args' cap' slot' excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (TcbIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap = transform_cap cap'; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (46 subgoals):
 1. \<And>x2. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = ArchInvocationLabel x2; x2 = ARMPDClean_Data\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 2. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = InvalidInvocation\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 3. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = UntypedRetype\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 4. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = TCBReadRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 5. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 6. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 7. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 8. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x1. \<lbrakk>cap = (case cap' of cap.NullCap \<Rightarrow> cdl_cap.NullCap | cap.UntypedCap dev ptr size_bits idx \<Rightarrow> cdl_cap.UntypedCap dev {ptr..ptr + 2 ^ size_bits - 1} (free_range_of_untyped idx size_bits ptr) | cap.EndpointCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.EndpointCap ptr badge cap_rights_ | cap.NotificationCap ptr badge cap_rights_ \<Rightarrow> cdl_cap.NotificationCap ptr badge cap_rights_ | cap.ReplyCap ptr is_master cap_rights_ \<Rightarrow> if is_master then MasterReplyCap ptr else cdl_cap.ReplyCap ptr cap_rights_ | cap.CNodeCap ptr size_bits guard \<Rightarrow> cdl_cap.CNodeCap ptr (of_bl guard) (length guard) size_bits | ThreadCap ptr \<Rightarrow> TcbCap ptr | cap.DomainCap \<Rightarrow> cdl_cap.DomainCap | IRQControlCap \<Rightarrow> IrqControlCap | IRQHandlerCap irq \<Rightarrow> IrqHandlerCap irq | Zombie ptr x xa \<Rightarrow> ZombieCap ptr | ArchObjectCap (ASIDPoolCap ptr asid) \<Rightarrow> AsidPoolCap ptr (fst $ transform_asid asid) | ArchObjectCap ASIDControlCap \<Rightarrow> AsidControlCap | ArchObjectCap (PageCap dev ptr cap_rights_ sz mp) \<Rightarrow> FrameCap dev ptr cap_rights_ (pageBitsForSize sz) Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageTableCap ptr mp) \<Rightarrow> cdl_cap.PageTableCap ptr Real (transform_mapping mp) | ArchObjectCap (arch_cap.PageDirectoryCap ptr mp) \<Rightarrow> cdl_cap.PageDirectoryCap ptr Real (map_option transform_asid mp)); cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (invocation_type label') args' = Some (TcbIntent ui); ((invocation_type label' = GenInvocationLabel TCBReadRegisters) = (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBWriteRegisters) = (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! 1) (drop 2 args') \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBCopyRegisters) = (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! 1) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBConfigure) = (ui = TcbConfigureIntent (args' ! 0) (args' ! 1) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetPriority) = (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetMCPriority) = (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> 1 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSchedParams) = (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! 1)) \<and> 2 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSetSpace) = (ui = TcbSetSpaceIntent (args' ! 0) (args' ! 1) (args' ! 2) \<and> 3 \<le> length args') \<and> (invocation_type label' = GenInvocationLabel TCBSuspend) = (ui = TcbSuspendIntent) \<and> (invocation_type label' = GenInvocationLabel TCBResume) = (ui = TcbResumeIntent) \<and> (invocation_type label' = GenInvocationLabel TCBBindNotification) = (ui = TcbBindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBUnbindNotification) = (ui = TcbUnbindNTFNIntent) \<and> (invocation_type label' = GenInvocationLabel TCBSetTLSBase) = (ui = TcbSetTLSBaseIntent)) \<and> invocation_type label' \<noteq> GenInvocationLabel InvalidInvocation \<and> invocation_type label' \<noteq> GenInvocationLabel UntypedRetype \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRevoke \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeDelete \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCancelBadgedSends \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeCopy \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMint \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMove \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeMutate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeRotate \<and> invocation_type label' \<noteq> GenInvocationLabel CNodeSaveCaller \<and> invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQAckIRQ \<and> invocation_type label' \<noteq> GenInvocationLabel IRQSetIRQHandler \<and> invocation_type label' \<noteq> GenInvocationLabel IRQClearIRQHandler \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageTableUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageMap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnmap \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPageGetAddress \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDClean_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDCleanInvalidate_Data \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMPDUnify_Instruction \<and> invocation_type label' \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<and> invocation_type label' \<noteq> GenInvocationLabel DomainSetSet; invocation_type label' = GenInvocationLabel x1; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 46 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<and> 2 \<le> length args' \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBReadRegisters; x1 = TCBReadRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (args' ! 0 !! 0) 0 0) \<sqinter> throw) (decode_read_registers args' (ThreadCap t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<and> 2 \<le> length args' \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBReadRegisters; x1 = TCBReadRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (args' ! 0 !! 0) 0 0) \<sqinter> throw) (decode_read_registers args' (ThreadCap t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'\<rbrakk> \<Longrightarrow> (args' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t ([] ! 0 !! 0) 0 0) \<sqinter> throw) (throwError TruncatedMessage)) \<and> (\<forall>x21 x22. (x22 = [] \<longrightarrow> args' = [x21] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (throwError TruncatedMessage)) \<and> (\<forall>x21a x22a. x22 = x21a # x22a \<longrightarrow> args' = x21 # x21a # x22a \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (doE y <- range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters));
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)
odE)))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; args' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t ([] ! 0 !! 0) 0 0) \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x22. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = []; args' = [x21]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (throwError TruncatedMessage)
 3. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (doE y <- range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters));
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)
odE)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
A total of 18 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (doE y <- range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters));
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) >>= lift (\<lambda>y. liftE (gets cur_thread) >>= lift (\<lambda>self. whenE (t = self) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)))))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (lift (\<lambda>y. liftE (gets cur_thread) >>= lift (\<lambda>self. whenE (t = self) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)))) rv)
 2. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 3. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>x21 x22 x21a x22a rv a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inl a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (lift (\<lambda>y. liftE (gets cur_thread) >>= lift (\<lambda>self. whenE (t = self) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)))) rv)
 2. \<And>x21 x22 x21a x22a rv b. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (lift (\<lambda>y. liftE (gets cur_thread) >>= lift (\<lambda>self. whenE (t = self) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)))) rv)
 3. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 4. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>x21 x22 x21a x22a rv a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inl a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (throwError a)
 2. \<And>x21 x22 x21a x22a rv b. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (lift (\<lambda>y. liftE (gets cur_thread) >>= lift (\<lambda>self. whenE (t = self) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)))) rv)
 3. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 4. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>x21 x22 x21a x22a rv b. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr b\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (lift (\<lambda>y. liftE (gets cur_thread) >>= lift (\<lambda>self. whenE (t = self) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)))) rv)
 2. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 3. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (liftE (gets cur_thread) >>= lift (\<lambda>self. whenE (t = self) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters))))
 2. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 3. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (do r <- gets cur_thread;
whenE (t = r) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters))
od)
 2. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 3. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
A total of 19 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x21 x22 x21a x22a rv r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (whenE (t = r) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)))
 2. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>x21 x22 x21a x22a rv s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True) (gets cur_thread)
 5. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 6. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x21 x22 x21a x22a rv r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (doE y <- whenE (t = r) (throwError IllegalOperation);
returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters)
odE)
 2. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>x21 x22 x21a x22a rv s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True) (gets cur_thread)
 5. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 6. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
A total of 22 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>x21 x22 x21a x22a rv r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); t = r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (throwError IllegalOperation)
 2. \<And>x21 x22 x21a x22a rv r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); t \<noteq> r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters))
 3. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 4. \<And>x21 x22 x21a x22a rv s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True) (gets cur_thread)
 6. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 7. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>x21 x22 x21a x22a rv r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); t = r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) throw (throwError IllegalOperation)
 2. \<And>x21 x22 x21a x22a rv r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); t \<noteq> r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters))
 3. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 4. \<And>x21 x22 x21a x22a rv s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True) (gets cur_thread)
 6. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 7. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x21 x22 x21a x22a rv r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); t \<noteq> r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0) \<sqinter> throw) (returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters))
 2. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>x21 x22 x21a x22a rv s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True) (gets cur_thread)
 5. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 6. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x21 x22 x21a x22a rv r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); t \<noteq> r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.ReadRegisters t (x21 !! 0) 0 0)) (returnOk (tcb_invocation.ReadRegisters t (x21 !! 0) x21a ArchDefaultExtraRegisters))
 2. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>x21 x22 x21a x22a rv s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True) (gets cur_thread)
 5. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 6. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr ()\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 2. \<And>x21 x22 x21a x22a rv s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>x21 x22 x21a x22a rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbReadRegistersIntent (x21 !! 0) 0 x21a)); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (x21 !! 0) 0 x21a; x22 = x21a # x22a; args' = x21 # x21a # x22a; rv = Inr (); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s. True) (gets cur_thread)
 4. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>rv s. True\<rbrace>
 5. \<And>x21 x22 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
A total of 21 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBReadRegisters) args' = Some (TcbIntent (TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0))); gen_invocation_type label' = TCBReadRegisters; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (range_check x21a 1 (word_of_nat (length frameRegisters) + word_of_nat (length gpRegisters)))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<and> 2 \<le> length args' \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBWriteRegisters; x1 = TCBWriteRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (args' ! 0 !! 0) [0] 0) \<sqinter> throw) (decode_write_registers args' (ThreadCap t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'\<rbrakk> \<Longrightarrow> (args' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t ([] ! 0 !! 0) [0] 0) \<sqinter> throw) (throwError TruncatedMessage)) \<and> (\<forall>x21 x22. (x22 = [] \<longrightarrow> args' = [x21] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (throwError TruncatedMessage)) \<and> (\<forall>x21a x22a. x22 = x21a # x22a \<longrightarrow> args' = x21 # x21a # x22a \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (doE y <- whenE (length x22a < unat x21a) (throwError TruncatedMessage);
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)
odE)))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; args' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t ([] ! 0 !! 0) [0] 0) \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x22. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; x22 = []; args' = [x21]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (throwError TruncatedMessage)
 3. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (doE y <- whenE (length x22a < unat x21a) (throwError TruncatedMessage);
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)
odE)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; args' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t ([] ! 0 !! 0) [0] 0) \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x22. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; x22 = []; args' = [x21]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (throwError TruncatedMessage)
 3. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (doE y <- whenE (length x22a < unat x21a) (throwError TruncatedMessage);
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)
odE)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x21 x22. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; x22 = []; args' = [x21]\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (doE y <- whenE (length x22a < unat x21a) (throwError TruncatedMessage);
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)
odE)
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x21 x22 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) args' = Some (TcbIntent (TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'))); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args'); 2 \<le> length args'; x22 = x21a # x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (doE y <- whenE (length x22a < unat x21a) (throwError TruncatedMessage);
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (doE y <- whenE (length x22a < unat x21a) (throwError TruncatedMessage);
self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; length x22a < unat x21a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (doE self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)
odE)
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (doE self <- liftE (gets cur_thread);
y <- whenE (t = self) (throwError IllegalOperation);
returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (do r <- gets cur_thread;
whenE (t = r) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters))
od)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x22a r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (whenE (t = r) (throwError IllegalOperation) >>= lift (\<lambda>y. returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters)))
 2. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>x21 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>x21 x21a x22a r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; t = r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (throwError IllegalOperation)
 2. \<And>x21 x21a x22a r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; t \<noteq> r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters))
 3. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 4. \<And>x21 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x22a r. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; t \<noteq> r\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>s. True) (returnOk (cdl_tcb_invocation.WriteRegisters t (x21 !! 0) [0] 0) \<sqinter> throw) (returnOk (tcb_invocation.WriteRegisters t (x21 !! 0) (take (unat x21a) x22a) ArchDefaultExtraRegisters))
 2. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>x21 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. True\<rbrace>
 2. \<And>x21 x21a x22a s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>x21 x21a x22a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBWriteRegisters) (x21 # x21a # x22a) = Some (TcbIntent (TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a)); gen_invocation_type label' = TCBWriteRegisters; ui = TcbWriteRegistersIntent (x21 !! 0) 0 x21a x22a; args' = x21 # x21a # x22a; \<not> length x22a < unat x21a; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
A total of 17 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<and> Suc 0 \<le> length args' \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBCopyRegisters; x1 = TCBCopyRegisters\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (decode_copy_registers args' (ThreadCap t) (map fst excaps'))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0; Suc 0 \<le> length args'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (case args' of [] \<Rightarrow> throwError TruncatedMessage | flags # x \<Rightarrow> doE suspend_source <- returnOk (flags !! 0);
resume_target <- returnOk (flags !! 1);
transfer_frame <- returnOk (flags !! 2);
transfer_integer <- returnOk (flags !! 3);
whenE (map fst excaps' = []) $ throwError TruncatedMessage;
src_tcb <- case map fst excaps' of [] \<Rightarrow> throwError $ InvalidCapability 1 | ThreadCap xa # x \<Rightarrow> returnOk xa | _ # x \<Rightarrow> throwError $ InvalidCapability 1;
p <- case ThreadCap t of ThreadCap x \<Rightarrow> returnOk x;
returnOk $ tcb_invocation.CopyRegisters p src_tcb suspend_source resume_target transfer_frame transfer_integer ArchDefaultExtraRegisters
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0; Suc 0 \<le> length args'; args' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (case args' of [] \<Rightarrow> throwError TruncatedMessage | flags # x \<Rightarrow> doE suspend_source <- returnOk (flags !! 0);
resume_target <- returnOk (flags !! 1);
transfer_frame <- returnOk (flags !! 2);
transfer_integer <- returnOk (flags !! 3);
whenE (map fst excaps' = []) $ throwError TruncatedMessage;
src_tcb <- case map fst excaps' of [] \<Rightarrow> throwError $ InvalidCapability 1 | ThreadCap xa # x \<Rightarrow> returnOk xa | _ # x \<Rightarrow> throwError $ InvalidCapability 1;
p <- case ThreadCap t of ThreadCap x \<Rightarrow> returnOk x;
returnOk $ tcb_invocation.CopyRegisters p src_tcb suspend_source resume_target transfer_frame transfer_integer ArchDefaultExtraRegisters
odE)
 2. \<And>a list. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) args' = Some (TcbIntent (TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0; Suc 0 \<le> length args'; args' = a # list\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0)
odE \<sqinter> throw) (case args' of [] \<Rightarrow> throwError TruncatedMessage | flags # x \<Rightarrow> doE suspend_source <- returnOk (flags !! 0);
resume_target <- returnOk (flags !! 1);
transfer_frame <- returnOk (flags !! 2);
transfer_integer <- returnOk (flags !! 3);
whenE (map fst excaps' = []) $ throwError TruncatedMessage;
src_tcb <- case map fst excaps' of [] \<Rightarrow> throwError $ InvalidCapability 1 | ThreadCap xa # x \<Rightarrow> returnOk xa | _ # x \<Rightarrow> throwError $ InvalidCapability 1;
p <- case ThreadCap t of ThreadCap x \<Rightarrow> returnOk x;
returnOk $ tcb_invocation.CopyRegisters p src_tcb suspend_source resume_target transfer_frame transfer_integer ArchDefaultExtraRegisters
odE)
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a list. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case map fst excaps' of [] \<Rightarrow> throwError $ InvalidCapability 1 | ThreadCap xa # x \<Rightarrow> returnOk xa | _ # x \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a list. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' \<noteq> []; map fst excaps' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case map fst excaps' of [] \<Rightarrow> throwError $ InvalidCapability 1 | ThreadCap xa # x \<Rightarrow> returnOk xa | _ # x \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 2. \<And>a list aa lista. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' \<noteq> []; map fst excaps' = aa # lista\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case map fst excaps' of [] \<Rightarrow> throwError $ InvalidCapability 1 | ThreadCap xa # x \<Rightarrow> returnOk xa | _ # x \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 2. \<And>a list ab ac b zs x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 3. \<And>a list ab ac b zs x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 4. \<And>a list ab ac b zs x41 x42 x43. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 5. \<And>a list ab ac b zs x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 6. \<And>a list ab ac b zs x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 7. \<And>a list ab ac b zs x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 8. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 9. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 10. \<And>a list ab ac b zs x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
A total of 25 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>a list ac b zs x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (TcbCap x7, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ThreadCap x7, ac, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.CopyRegisters t x7 (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0) \<sqinter> throw) (returnOk (tcb_invocation.CopyRegisters t x7 (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters))
 2. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 3. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 4. \<And>a list ab ac b zs x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 5. \<And>a list ab ac b zs x111 x112 x113. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 6. \<And>a list ab ac b zs x12. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>a list ac b zs x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (TcbCap x7, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ThreadCap x7, ac, b) # zs\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.CopyRegisters t x7 (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)) (returnOk (tcb_invocation.CopyRegisters t x7 (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters))
 2. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 3. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 4. \<And>a list ab ac b zs x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 5. \<And>a list ab ac b zs x111 x112 x113. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 6. \<And>a list ab ac b zs x12. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 2. \<And>a list ab ac b zs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 3. \<And>a list ab ac b zs x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 4. \<And>a list ab ac b zs x111 x112 x113. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 5. \<And>a list ab ac b zs x12. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = (transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs; transform_intent (GenInvocationLabel TCBCopyRegisters) (a # list) = Some (TcbIntent (TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)); gen_invocation_type label' = TCBCopyRegisters; ui = TcbCopyRegistersIntent (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0; args' = a # list; excaps' = (ab, ac, b) # zs; ab = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (source_cap, uu_) <- throw_on_none (get_index ((transform_cap ab, transform_cslot_ptr (ac, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) zs) 0);
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
returnOk (cdl_tcb_invocation.CopyRegisters t source_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) 0)
odE \<sqinter> throw) (doE src_tcb <- case ab of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError $ InvalidCapability 1;
returnOk (tcb_invocation.CopyRegisters t src_tcb (a !! 0) (a !! Suc 0) (a !! 2) (a !! 3) ArchDefaultExtraRegisters)
odE)
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
A total of 18 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<and> 4 \<le> length args' \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBConfigure; x1 = TCBConfigure\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_tcb_configure args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (doE set_params <- decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2];
set_space <- decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps');
returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep set_space) None None (tc_new_croot set_space) (tc_new_vroot set_space) (tc_new_buffer set_params))
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b c. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (doE set_params <- decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2];
set_space <- decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps');
returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep set_space) None None (tc_new_croot set_space) (tc_new_vroot set_space) (tc_new_buffer set_params))
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b c aa ba ca. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (doE set_params <- decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2];
set_space <- decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps');
returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep set_space) None None (tc_new_croot set_space) (tc_new_vroot set_space) (tc_new_buffer set_params))
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (doE set_params <- decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2];
set_space <- decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps');
returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep set_space) None None (tc_new_croot set_space) (tc_new_vroot set_space) (tc_new_buffer set_params))
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b c aa ba ca ab bb cb s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2] \<lbrace>\<lambda>rv s'. s' = s \<and> ?rvP266 a b c aa ba ca ab bb cb rv\<rbrace>, \<lbrace>\<lambda>ft. (=) s\<rbrace>
 2. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); ?rvP266 a b c aa ba ca ab bb cb rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (doE set_space <- decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps');
returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep set_space) None None (tc_new_croot set_space) (tc_new_vroot set_space) (tc_new_buffer rv))
odE)
 3. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a b c aa ba ca ab bb cb s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb)\<rbrakk> \<Longrightarrow> [args' ! 3] \<noteq> []
 2. \<And>a b c aa ba ca ab bb cb s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb)\<rbrakk> \<Longrightarrow> [excaps' ! 2] ! 0 = (a, b, c)
 3. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if [args' ! 3] ! 0 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (doE set_space <- decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps');
returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep set_space) None None (tc_new_croot set_space) (tc_new_vroot set_space) (tc_new_buffer rv))
odE)
 4. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (doE set_space <- decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps');
returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep set_space) None None (tc_new_croot set_space) (tc_new_vroot set_space) (tc_new_buffer rv))
odE)
 2. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps') \<lbrace>\<lambda>rva s'. s' = s \<and> ?rvP271 a b c aa ba ca ab bb cb rv rva\<rbrace>, \<lbrace>\<lambda>ft. (=) s\<rbrace>
 2. \<And>a b c aa ba ca ab bb cb rv rva. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); ?rvP271 a b c aa ba ca ab bb cb rv rva\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rva) None None (tc_new_croot rva) (tc_new_vroot rva) (tc_new_buffer rv)))
 3. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 4. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv rva. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); rva = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rva) None None (tc_new_croot rva) (tc_new_vroot rva) None \<and> tc_new_fault_ep rva = Some (to_bl ([args' ! 0, args' ! Suc 0, args' ! 2] ! 0)) \<and> map_option snd (tc_new_croot rva) = Some (snd (take 2 excaps' ! 0)) \<and> map_option snd (tc_new_vroot rva) = Some (snd (take 2 excaps' ! Suc 0)) \<and> map_option fst (tc_new_croot rva) = (if [args' ! 0, args' ! Suc 0, args' ! 2] ! 1 = 0 then Some (fst (take 2 excaps' ! 0)) else Some (CSpace_A.update_cap_data False ([args' ! 0, args' ! Suc 0, args' ! 2] ! Suc 0) (fst (take 2 excaps' ! 0)))) \<and> map_option fst (tc_new_vroot rva) = Some (fst (take 2 excaps' ! Suc 0)) \<and> map_option (\<lambda>c. Structures_A.is_cnode_cap (fst c)) (tc_new_croot rva) = Some True\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) (if args' ! 3 \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rva) None None (tc_new_croot rva) (tc_new_vroot rva) (tc_new_buffer rv)))
 2. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 3. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af\<rbrakk> \<Longrightarrow> (args' ! 3 \<noteq> 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) (Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)))) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv))))) \<and> (args' ! 3 = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))))
 2. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 3. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) (Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)))) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))
 2. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))
 3. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af\<rbrakk> \<Longrightarrow> args' ! 3 = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv))))
 4. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 5. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) (Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))) = translate_tcb_invocation (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv))
 2. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))
 3. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af\<rbrakk> \<Longrightarrow> args' ! 3 = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv))))
 4. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 5. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c)); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))
 2. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af\<rbrakk> \<Longrightarrow> args' ! 3 = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv))))
 3. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 4. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af\<rbrakk> \<Longrightarrow> args' ! 3 = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv))))
 2. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 3. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0)); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0; 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = None; Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 = 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))
 2. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0)); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0; 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = None; Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 = 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))
 3. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 4. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0)); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0; 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = None; Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 = 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (transform_cap ab) (args' ! Suc 0), transform_cslot_ptr (bb, cb))) (Some (transform_cap aa, transform_cslot_ptr (ba, ca))) None = translate_tcb_invocation (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv))
 2. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0)); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0; 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = None; Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 = 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))
 3. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 4. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b c aa ba ca ab bb cb rv af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0)); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) 0; 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = None; Some af = (if args' ! Suc 0 = 0 then Some ab else Some (CSpace_A.update_cap_data False (args' ! Suc 0) ab)); Structures_A.is_cnode_cap af; args' ! 3 = 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (af, bb, cb)) (Some (aa, ba, ca)) (tc_new_buffer rv)))
 2. \<And>a b c aa ba ca ab bb cb rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if args' ! 3 = 0 then None else Some (reset_mem_mapping (transform_cap a), transform_cslot_ptr (b, c))); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space [args' ! 0, args' ! Suc 0, args' ! 2] (ThreadCap t) slot' (take 2 excaps'))
 3. \<And>a b c aa ba ca ab bb cb. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBConfigure) args' = Some (TcbIntent (TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3))); gen_invocation_type label' = TCBConfigure; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3); 4 \<le> length args'; \<not> length excaps' < 3; excaps' ! 2 = (a, b, c); excaps' ! Suc 0 = (aa, ba, ca); excaps' ! 0 = (ab, bb, cb); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer [args' ! 3] (ThreadCap t) slot' [excaps' ! 2])
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetPriority; x1 = TCBSetPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
A total of 15 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_priority args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (doE auth_tcb <- case fst (excaps' ! 0) of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError (InvalidCapability 1);
y <- check_prio (args' ! 0) auth_tcb;
returnOk (tcb_invocation.ThreadControl t slot' None None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), auth_tcb)) None None None)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (doE y <- check_prio (args' ! 0) x7;
returnOk (tcb_invocation.ThreadControl t slot' None None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) None None None)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' None None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) None None None))
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)) (returnOk (tcb_invocation.ThreadControl t slot' None None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) None None None))
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None = translate_tcb_invocation (tcb_invocation.ThreadControl t slot' None None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) None None None)
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetPriority) args' = Some (TcbIntent (TcbSetPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetPriority; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<and> Suc 0 \<le> length args' \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetMCPriority; x1 = TCBSetMCPriority\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_mcpriority args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (doE auth_tcb <- case fst (excaps' ! 0) of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError (InvalidCapability 1);
y <- check_prio (args' ! 0) auth_tcb;
returnOk (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), auth_tcb)) None None None None)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (doE y <- check_prio (args' ! 0) x7;
returnOk (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) None None None None)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) None None None None))
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)) (returnOk (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) None None None None))
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None = translate_tcb_invocation (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) None None None None)
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetMCPriority) args' = Some (TcbIntent (TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)))); gen_invocation_type label' = TCBSetMCPriority; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)); Suc 0 \<le> length args'; args' \<noteq> []; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (10 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<and> 2 \<le> length args' \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSchedParams; x1 = TCBSetSchedParams\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE auth_cap <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_sched_params args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (doE auth_tcb <- case fst (excaps' ! 0) of ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throwError (InvalidCapability 1);
y <- check_prio (args' ! 0) auth_tcb;
y <- check_prio (args' ! Suc 0) auth_tcb;
returnOk (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), auth_tcb)) (Some (UCAST(32 \<rightarrow> 8) (args' ! Suc 0), auth_tcb)) None None None)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (10 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (doE y <- check_prio (args' ! 0) x7;
y <- check_prio (args' ! Suc 0) x7;
returnOk (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) (Some (UCAST(32 \<rightarrow> 8) (args' ! Suc 0), x7)) None None None)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (14 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) (Some (UCAST(32 \<rightarrow> 8) (args' ! Suc 0), x7)) None None None))
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! Suc 0) x7 \<lbrace>\<lambda>y. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! Suc 0) x7)
 4. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None)) (returnOk (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) (Some (UCAST(32 \<rightarrow> 8) (args' ! Suc 0), x7)) None None None))
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! Suc 0) x7 \<lbrace>\<lambda>y. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! Suc 0) x7)
 4. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None = translate_tcb_invocation (tcb_invocation.ThreadControl t slot' None (Some (UCAST(32 \<rightarrow> 8) (args' ! 0), x7)) (Some (UCAST(32 \<rightarrow> 8) (args' ! Suc 0), x7)) None None None)
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! Suc 0) x7 \<lbrace>\<lambda>y. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! Suc 0) x7)
 4. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! Suc 0) x7 \<lbrace>\<lambda>y. (=) s\<rbrace>
 2. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! Suc 0) x7)
 3. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! Suc 0) x7)
 2. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x7 s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_prio (args' ! 0) x7 \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSchedParams) args' = Some (TcbIntent (TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)))); gen_invocation_type label' = TCBSetSchedParams; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)); 2 \<le> length args'; excaps' \<noteq> []; fst (excaps' ! 0) = ThreadCap x7\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (check_prio (args' ! 0) x7)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (9 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (9 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetIPCBuffer) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetIPCBuffer; x1 = TCBSetIPCBuffer\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; (case args' of [] \<Rightarrow> None | buffer # x \<Rightarrow> Some (TcbSetIPCBufferIntent buffer)) = Some ui; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args'; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args'; ui \<noteq> TcbSuspendIntent; ui \<noteq> TcbResumeIntent; ui \<noteq> TcbBindNTFNIntent; ui \<noteq> TcbUnbindNTFNIntent; ui \<noteq> TcbSetTLSBaseIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object (TcbCap t)) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object (TcbCap t)) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object (TcbCap t);
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object (TcbCap t))) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object (TcbCap t))) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
vspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 1;
buffer_frame <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
vspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object (TcbCap t)) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object (TcbCap t)) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object (TcbCap t))) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; (case args' of [] \<Rightarrow> None | buffer # x \<Rightarrow> Some (TcbSetIPCBufferIntent buffer)) = Some ui; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args'; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args'; ui \<noteq> TcbSuspendIntent; ui \<noteq> TcbResumeIntent; ui \<noteq> TcbBindNTFNIntent; ui \<noteq> TcbUnbindNTFNIntent; ui \<noteq> TcbSetTLSBaseIntent; args' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object (TcbCap t)) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object (TcbCap t)) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object (TcbCap t);
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object (TcbCap t))) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object (TcbCap t))) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
vspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 1;
buffer_frame <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
vspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object (TcbCap t)) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object (TcbCap t)) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object (TcbCap t))) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 2. \<And>a list. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; (case args' of [] \<Rightarrow> None | buffer # x \<Rightarrow> Some (TcbSetIPCBufferIntent buffer)) = Some ui; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args'; ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args'; ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args'; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args'; ui \<noteq> TcbSuspendIntent; ui \<noteq> TcbResumeIntent; ui \<noteq> TcbBindNTFNIntent; ui \<noteq> TcbUnbindNTFNIntent; ui \<noteq> TcbSetTLSBaseIntent; args' = a # list\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object (TcbCap t)) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object (TcbCap t)) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object (TcbCap t);
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object (TcbCap t))) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object (TcbCap t))) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
vspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 1;
buffer_frame <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
vspace_root <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object (TcbCap t)) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object (TcbCap t)) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object (TcbCap t))) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object (TcbCap t)) (transform_cslot_ptr slot') None None None None)
odE \<sqinter> throw) (decode_set_ipc_buffer args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (9 subgoals):
 1. \<And>a list. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None (if a \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (9 subgoals):
 1. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE buffer_frame <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None (if a \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None))
odE \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (11 subgoals):
 1. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None (Some (reset_mem_mapping (transform_cap aa), transform_cslot_ptr (b, c)))) \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' excaps')
 2. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' [])
 3. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c)\<rbrakk> \<Longrightarrow> a = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' []))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a list aa b c s. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> decode_set_ipc_buffer (a # list) (ThreadCap t) slot' excaps' \<lbrace>\<lambda>rv s'. s' = s \<and> ?Q603 a list aa b c rv\<rbrace>, \<lbrace>\<lambda>ft. (=) s\<rbrace>
 2. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' excaps')
 3. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>rv. ?Q603 a list aa b c rv \<longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None (Some (reset_mem_mapping (transform_cap aa), transform_cslot_ptr (b, c))) = translate_tcb_invocation rv
 4. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' [])
 5. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c)\<rbrakk> \<Longrightarrow> a = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' []))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a list aa b c s. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> a # list \<noteq> []
 2. \<And>a list aa b c s. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> excaps' ! 0 = (?a608 a list aa b c, ?b609 a list aa b c, ?c610 a list aa b c)
 3. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' excaps')
 4. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>rv. rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if (a # list) ! 0 = 0 then None else Some (reset_mem_mapping (transform_cap (?a608 a list aa b c)), transform_cslot_ptr (?b609 a list aa b c, ?c610 a list aa b c))) \<longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None (Some (reset_mem_mapping (transform_cap aa), transform_cslot_ptr (b, c))) = translate_tcb_invocation rv
 5. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' [])
 6. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c)\<rbrakk> \<Longrightarrow> a = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' []))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
A total of 14 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>rv. rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv) \<and> translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = (if (a # list) ! 0 = 0 then None else Some (reset_mem_mapping (transform_cap aa), transform_cslot_ptr (b, c))) \<longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None (Some (reset_mem_mapping (transform_cap aa), transform_cslot_ptr (b, c))) = translate_tcb_invocation rv
 2. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' [])
 3. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c)\<rbrakk> \<Longrightarrow> a = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' []))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a list aa b c rv. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0; excaps' \<noteq> []; rv = tcb_invocation.ThreadControl t slot' None None None None None (tc_new_buffer rv); translate_tcb_invocation_thread_ctrl_buffer (tc_new_buffer rv) = Some (reset_mem_mapping (transform_cap aa), transform_cslot_ptr (b, c))\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None (Some (reset_mem_mapping (transform_cap aa), transform_cslot_ptr (b, c))) = translate_tcb_invocation rv
 2. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' [])
 3. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c)\<rbrakk> \<Longrightarrow> a = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' []))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c); a \<noteq> 0\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (a # list) (ThreadCap t) slot' [])
 2. \<And>a list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = a # list; ui = TcbSetIPCBufferIntent a; excaps' ! 0 = (aa, b, c)\<rbrakk> \<Longrightarrow> a = 0 \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_ipc_buffer (0 # list) (ThreadCap t) slot' []))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (9 subgoals):
 1. \<And>list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = 0 # list; ui = TcbSetIPCBufferIntent 0; excaps' ! 0 = (aa, b, c); excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None) \<sqinter> throw) (returnOk (tcb_invocation.ThreadControl t slot' None None None None None (Some (0, None))))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (9 subgoals):
 1. \<And>list aa b c. \<lbrakk>cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; gen_invocation_type label' = TCBSetIPCBuffer; cap = TcbCap t; args' = 0 # list; ui = TcbSetIPCBufferIntent 0; excaps' ! 0 = (aa, b, c); excaps' \<noteq> []\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') None None None None = translate_tcb_invocation (tcb_invocation.ThreadControl t slot' None None None None None (Some (0, None)))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (8 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (8 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<and> 3 \<le> length args' \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetSpace; x1 = TCBSetSpace\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE cspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
vspace_root <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') (Suc 0));
returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst cspace_root) (args' ! Suc 0), snd cspace_root)) (Some vspace_root) None)
odE \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) (args' ! Suc 0), snd (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)))) (Some (case excaps' ! Suc 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) None) \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' [])
 3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'\<rbrakk> \<Longrightarrow> \<not> Suc 0 < length excaps' \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' []))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (12 subgoals):
 1. \<And>s. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> decode_set_space args' (ThreadCap t) slot' excaps' \<lbrace>\<lambda>rv s'. s' = s \<and> ?Q690 rv\<rbrace>, \<lbrace>\<lambda>ft. (=) s\<rbrace>
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space args' (ThreadCap t) slot' excaps')
 3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>rv. ?Q690 rv \<longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) (args' ! Suc 0), snd (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)))) (Some (case excaps' ! Suc 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) None = translate_tcb_invocation rv
 4. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' [])
 5. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'\<rbrakk> \<Longrightarrow> \<not> Suc 0 < length excaps' \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' []))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 10. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (decode_set_space args' (ThreadCap t) slot' excaps')
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>rv. rv = tcb_invocation.ThreadControl t slot' (tc_new_fault_ep rv) None None (tc_new_croot rv) (tc_new_vroot rv) None \<and> tc_new_fault_ep rv = Some (to_bl (args' ! 0)) \<and> map_option snd (tc_new_croot rv) = Some (snd (excaps' ! 0)) \<and> map_option snd (tc_new_vroot rv) = Some (snd (excaps' ! Suc 0)) \<and> map_option fst (tc_new_croot rv) = (if args' ! 1 = 0 then Some (fst (excaps' ! 0)) else Some (CSpace_A.update_cap_data False (args' ! Suc 0) (fst (excaps' ! 0)))) \<and> map_option fst (tc_new_vroot rv) = Some (fst (excaps' ! Suc 0)) \<and> map_option (\<lambda>c. Structures_A.is_cnode_cap (fst c)) (tc_new_croot rv) = Some True \<longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) (args' ! Suc 0), snd (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)))) (Some (case excaps' ! Suc 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) None = translate_tcb_invocation rv
 3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' [])
 4. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'\<rbrakk> \<Longrightarrow> \<not> Suc 0 < length excaps' \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' []))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 9. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b ba ad af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []; Some a = (if args' ! Suc 0 = 0 then Some (fst (excaps' ! 0)) else Some (CSpace_A.update_cap_data False (args' ! Suc 0) (fst (excaps' ! 0)))); snd (excaps' ! Suc 0) = (ad, ba); Structures_A.is_cnode_cap a; snd (excaps' ! 0) = (af, b)\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.ThreadControl t (transform_cslot_ptr slot') (Some (args' ! 0)) (Some (cdl_update_cnode_cap_data (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) (args' ! Suc 0), snd (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)))) (Some (case excaps' ! Suc 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) None = translate_tcb_invocation (tcb_invocation.ThreadControl t slot' (Some (to_bl (args' ! 0))) None None (Some (a, af, b)) (Some (fst (excaps' ! Suc 0), ad, ba)) None)
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' [])
 3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'\<rbrakk> \<Longrightarrow> \<not> Suc 0 < length excaps' \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' []))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (10 subgoals):
 1. \<And>a b ba ad af. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []; Some a = (if args' ! Suc 0 = 0 then Some (fst (excaps' ! 0)) else Some (CSpace_A.update_cap_data False (args' ! Suc 0) (fst (excaps' ! 0)))); snd (excaps' ! Suc 0) = (ad, ba); Structures_A.is_cnode_cap a; snd (excaps' ! 0) = (af, b)\<rbrakk> \<Longrightarrow> cdl_update_cnode_cap_data (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) (args' ! Suc 0) = transform_cap a \<and> snd (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) = transform_cslot_ptr (af, b) \<and> (case excaps' ! Suc 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) = (transform_cap (fst (excaps' ! Suc 0)), transform_cslot_ptr (ad, ba))
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' [])
 3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'\<rbrakk> \<Longrightarrow> \<not> Suc 0 < length excaps' \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' []))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (10 subgoals):
 1. \<And>a b ba ad af aa bb ab bc. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'; excaps' \<noteq> []; Some a = (if args' ! Suc 0 = 0 then Some aa else Some (CSpace_A.update_cap_data False (args' ! Suc 0) aa)); bc = ad; Structures_A.is_cnode_cap a; bb = af; excaps' ! 0 = (aa, af, b); excaps' ! Suc 0 = (ab, ad, ba)\<rbrakk> \<Longrightarrow> cdl_update_cnode_cap_data (transform_cap aa) (args' ! Suc 0) = transform_cap a
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' [])
 3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'\<rbrakk> \<Longrightarrow> \<not> Suc 0 < length excaps' \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' []))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 8. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 10. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'; Suc 0 < length excaps'\<rbrakk> \<Longrightarrow> excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' [])
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetSpace) args' = Some (TcbIntent (TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2))); gen_invocation_type label' = TCBSetSpace; ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2); 3 \<le> length args'\<rbrakk> \<Longrightarrow> \<not> Suc 0 < length excaps' \<longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' excaps')) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (throw \<sqinter> throw) (decode_set_space args' (ThreadCap t) slot' []))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 7. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 9. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui = TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSuspend; x1 = TCBSuspend\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); gen_invocation_type label' = TCBSuspend; ui = TcbSuspendIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Suspend t) \<sqinter> throw) (returnOk (tcb_invocation.Suspend t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSuspend) args' = Some (TcbIntent TcbSuspendIntent); gen_invocation_type label' = TCBSuspend; ui = TcbSuspendIntent\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.Suspend t = translate_tcb_invocation (tcb_invocation.Suspend t)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (6 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (6 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui = TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBResume; x1 = TCBResume\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); gen_invocation_type label' = TCBResume; ui = TcbResumeIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.Resume t) \<sqinter> throw) (returnOk (tcb_invocation.Resume t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBResume) args' = Some (TcbIntent TcbResumeIntent); gen_invocation_type label' = TCBResume; ui = TcbResumeIntent\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.Resume t = translate_tcb_invocation (tcb_invocation.Resume t)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (5 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 4. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (5 subgoals):
 1. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui = TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBBindNotification; x1 = TCBBindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (decode_bind_notification (ThreadCap t) excaps')
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 4. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE nTFN <- liftE (get_bound_notification t);
y <- case nTFN of None \<Rightarrow> returnOk () | Some x \<Rightarrow> throwError IllegalOperation;
(ntfnptr, rights) <- case fst (hd excaps') of cap.NotificationCap ptr x r \<Rightarrow> returnOk (ptr, r) | _ \<Rightarrow> throwError IllegalOperation;
y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification ntfnptr);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some ntfnptr))
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 4. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 rv) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case rv of None \<Rightarrow> returnOk () | Some x \<Rightarrow> throwError IllegalOperation;
(ntfnptr, rights) <- case fst (hd excaps') of cap.NotificationCap ptr x r \<Rightarrow> returnOk (ptr, r) | _ \<Rightarrow> throwError IllegalOperation;
y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification ntfnptr);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some ntfnptr))
odE)
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> get_bound_notification t \<lbrace>?Q'788\<rbrace>
 3. \<And>cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_bound_notification t \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE (ntfnptr, rights) <- case fst (hd excaps') of cap.NotificationCap ptr x r \<Rightarrow> returnOk (ptr, r) | _ \<Rightarrow> throwError IllegalOperation;
y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification ntfnptr);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some ntfnptr))
odE)
 2. \<And>rv a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = Some a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 rv) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case rv of None \<Rightarrow> returnOk () | Some x \<Rightarrow> throwError IllegalOperation;
(ntfnptr, rights) <- case fst (hd excaps') of cap.NotificationCap ptr x r \<Rightarrow> returnOk (ptr, r) | _ \<Rightarrow> throwError IllegalOperation;
y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification ntfnptr);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some ntfnptr))
odE)
 3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> get_bound_notification t \<lbrace>?Q'788\<rbrace>
 4. \<And>cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_bound_notification t \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (8 subgoals):
 1. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE (ntfnptr, rights) <- case fst (hd excaps') of cap.NotificationCap ptr x r \<Rightarrow> returnOk (ptr, r) | _ \<Rightarrow> throwError IllegalOperation;
y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification ntfnptr);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some ntfnptr))
odE)
 2. \<And>rv a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = Some a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 rv) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case rv of None \<Rightarrow> returnOk () | Some x \<Rightarrow> throwError IllegalOperation;
(ntfnptr, rights) <- case fst (hd excaps') of cap.NotificationCap ptr x r \<Rightarrow> returnOk (ptr, r) | _ \<Rightarrow> throwError IllegalOperation;
y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification ntfnptr);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some ntfnptr))
odE)
 3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> get_bound_notification t \<lbrace>?Q'788\<rbrace>
 4. \<And>cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_bound_notification t \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui = TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; gen_invocation_type label' = TCBUnbindNotification; x1 = TCBUnbindNotification\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 6. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 7. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 8. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (19 subgoals):
 1. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 2. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 4. \<And>rv x41 x42 x43. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- if AllowRead \<notin> x43 then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification x41);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 5. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>rv x41 x42 x43. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- if AllowRead \<notin> x43 then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification x41);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 2. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 4. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 5. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification x41);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 2. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 4. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 5. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<notin> rights\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 2. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; \<not> AllowRead \<notin> rights\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification x41);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 3. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 4. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 5. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'788 None) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; \<not> AllowRead \<notin> rights\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- if AllowRead \<notin> rights then throwError IllegalOperation else returnOk ();
ntfn <- liftE (get_notification x41);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 2. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 4. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 5. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE ntfn <- liftE (get_notification x41);
y <- case ntfn_obj ntfn of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb ntfn of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 2. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 4. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 5. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x10. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 19 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>rv x41 x42 rights rva. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 rv x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case ntfn_obj rva of WaitingNtfn list \<Rightarrow> throwError IllegalOperation | _ \<Rightarrow> case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 2. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> get_notification x41 \<lbrace>?Q'801 rv x41 x42 rights\<rbrace>
 3. \<And>rv x41 x42 rights cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_notification x41 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 5. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 21 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>rv x41 x42 rights rva. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = IdleNtfn\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 2. \<And>rv x41 x42 rights rva x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x41 x42 rights rva x3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 4. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> get_notification x41 \<lbrace>?Q'801 rv x41 x42 rights\<rbrace>
 5. \<And>rv x41 x42 rights cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_notification x41 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>rv x41 x42 rights rva. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = IdleNtfn; ntfn_bound_tcb rva = None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (returnOk (tcb_invocation.NotificationControl t (Some x41)))
 2. \<And>rv x41 x42 rights rva a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = IdleNtfn; ntfn_bound_tcb rva = Some a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x41 x42 rights rva x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 4. \<And>rv x41 x42 rights rva x3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 5. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> get_notification x41 \<lbrace>?Q'801 rv x41 x42 rights\<rbrace>
 6. \<And>rv x41 x42 rights cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_notification x41 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>x41 x42 rights rva. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = IdleNtfn; ntfn_bound_tcb rva = None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) ((case case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot) of (ntfn_cap, uu_) \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))) \<sqinter> throw) (returnOk (tcb_invocation.NotificationControl t (Some x41)))
 2. \<And>rv x41 x42 rights rva a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = IdleNtfn; ntfn_bound_tcb rva = Some a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x41 x42 rights rva x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 4. \<And>rv x41 x42 rights rva x3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'801 None x41 x42 rights rva) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 5. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> get_notification x41 \<lbrace>?Q'801 rv x41 x42 rights\<rbrace>
 6. \<And>rv x41 x42 rights cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_notification x41 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>rv x41 x42 rights rva a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = IdleNtfn; ntfn_bound_tcb rva = Some a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 2. \<And>rv x41 x42 rights rva x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = WaitingNtfn x2\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 3. \<And>rv x41 x42 rights rva x3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (doE y <- case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 4. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> get_notification x41 \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>rv x41 x42 rights cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_notification x41 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 23 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>x41 x42 rights rva x3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn x3\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) ((case case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot) of (ntfn_cap, uu_) \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))) \<sqinter> throw) (doE y <- case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 2. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> get_notification x41 \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv x41 x42 rights cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_notification x41 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 5. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x41 x42 rights rva x3. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn x3; ntfn_bound_tcb rva = None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) ((case case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot) of (ntfn_cap, uu_) \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))) \<sqinter> throw) (returnOk (tcb_invocation.NotificationControl t (Some x41)))
 2. \<And>x41 x42 rights rva x3 a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn x3; ntfn_bound_tcb rva = Some a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) ((case case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot) of (ntfn_cap, uu_) \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))) \<sqinter> throw) (doE y <- case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 3. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> get_notification x41 \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv x41 x42 rights cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_notification x41 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x41 x42 rights rva word. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn word; ntfn_bound_tcb rva = None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) ((case case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot) of (ntfn_cap, uu_) \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))) \<sqinter> throw) (returnOk (tcb_invocation.NotificationControl t (Some x41)))
 2. \<And>x41 x42 rights rva x3 a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights; ntfn_obj rva = ActiveNtfn x3; ntfn_bound_tcb rva = Some a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) ((case case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot) of (ntfn_cap, uu_) \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))) \<sqinter> throw) (doE y <- case ntfn_bound_tcb rva of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throwError IllegalOperation;
returnOk (tcb_invocation.NotificationControl t (Some x41))
odE)
 3. \<And>rv x41 x42 rights. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> get_notification x41 \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv x41 x42 rights cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NotificationCap x41 x42 rights; AllowRead \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_notification x41 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 6. \<And>rv x21 x22 x23 x24. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 7. \<And>rv x31 x32 x33. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 8. \<And>rv x51 x52 x53. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 9. \<And>rv x61 x62 x63. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
 10. \<And>rv x7. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBBindNotification) args' = Some (TcbIntent TcbBindNTFNIntent); gen_invocation_type label' = TCBBindNotification; ui = TcbBindNTFNIntent; excaps' \<noteq> []; rv = None; fst (hd excaps') = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (doE (ntfn_cap, uu_) <- throw_on_none (get_index (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps') 0);
returnOk (cdl_tcb_invocation.NotificationControl t (Some (cap_object ntfn_cap)))
odE \<sqinter> throw) (throwError IllegalOperation)
A total of 22 subgoals... proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 4. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (decode_unbind_notification (ThreadCap t))
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 4. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (doE nTFN <- liftE (get_bound_notification t);
y <- case nTFN of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk ();
returnOk (tcb_invocation.NotificationControl t None)
odE)
 2. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 4. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (?Q'858 rv) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (doE y <- case rv of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk ();
returnOk (tcb_invocation.NotificationControl t None)
odE)
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> get_bound_notification t \<lbrace>?Q'858\<rbrace>
 3. \<And>cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_bound_notification t \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (6 subgoals):
 1. \<And>rv a. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent; rv = Some a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>a. True) (returnOk (cdl_tcb_invocation.NotificationControl t None) \<sqinter> throw) (doE y <- case rv of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk ();
returnOk (tcb_invocation.NotificationControl t None)
odE)
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> get_bound_notification t \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_bound_notification t \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 6. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> get_bound_notification t \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cs. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBUnbindNotification) args' = Some (TcbIntent TcbUnbindNTFNIntent); gen_invocation_type label' = TCBUnbindNotification; ui = TcbUnbindNTFNIntent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get_bound_notification t \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>x1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui = TcbSetTLSBaseIntent; gen_invocation_type label' = TCBSetTLSBase; x1 = TCBSetTLSBase\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 4. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 5. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); gen_invocation_type label' = TCBSetTLSBase; ui = TcbSetTLSBaseIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 2. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); gen_invocation_type label' = TCBSetTLSBase; ui = TcbSetTLSBaseIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (decode_set_tls_base args' (ThreadCap t))
 2. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); gen_invocation_type label' = TCBSetTLSBase; ui = TcbSetTLSBaseIntent\<rbrakk> \<Longrightarrow> (args' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (throwError TruncatedMessage)) \<and> (args' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (returnOk (tcb_invocation.SetTLSBase t (args' ! 0))))
 2. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) [] = Some (TcbIntent TcbSetTLSBaseIntent); gen_invocation_type label' = TCBSetTLSBase; ui = TcbSetTLSBaseIntent; args' = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (throwError TruncatedMessage)
 2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); gen_invocation_type label' = TCBSetTLSBase; ui = TcbSetTLSBaseIntent; args' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (returnOk (tcb_invocation.SetTLSBase t (args' ! 0)))
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 4. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); gen_invocation_type label' = TCBSetTLSBase; ui = TcbSetTLSBaseIntent; args' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (returnOk (cdl_tcb_invocation.SetTLSBase t) \<sqinter> throw) (returnOk (tcb_invocation.SetTLSBase t (args' ! 0)))
 2. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (GenInvocationLabel TCBSetTLSBase) args' = Some (TcbIntent TcbSetTLSBaseIntent); gen_invocation_type label' = TCBSetTLSBase; ui = TcbSetTLSBaseIntent; args' \<noteq> []\<rbrakk> \<Longrightarrow> cdl_tcb_invocation.SetTLSBase t = translate_tcb_invocation (tcb_invocation.SetTLSBase t (args' ! 0))
 2. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 3. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 2. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMASIDPoolAssign) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation)
 2. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>cap = TcbCap t; cap' = ThreadCap t; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args' = Some (TcbIntent ui); (ui = TcbReadRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbWriteRegistersIntent (args' ! 0 !! 0) 0 (args' ! Suc 0) (drop 2 args') \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbCopyRegistersIntent (args' ! 0 !! 0) (args' ! 0 !! Suc 0) (args' ! 0 !! 2) (args' ! 0 !! 3) 0 \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbConfigureIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) (args' ! 3) \<longrightarrow> \<not> 4 \<le> length args') \<and> (ui = TcbSetPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetMCPriorityIntent (prio_from_arg (args' ! 0)) \<longrightarrow> \<not> Suc 0 \<le> length args') \<and> (ui = TcbSetSchedParamsIntent (prio_from_arg (args' ! 0)) (prio_from_arg (args' ! Suc 0)) \<longrightarrow> \<not> 2 \<le> length args') \<and> (ui = TcbSetSpaceIntent (args' ! 0) (args' ! Suc 0) (args' ! 2) \<longrightarrow> \<not> 3 \<le> length args') \<and> ui \<noteq> TcbSuspendIntent \<and> ui \<noteq> TcbResumeIntent \<and> ui \<noteq> TcbBindNTFNIntent \<and> ui \<noteq> TcbUnbindNTFNIntent \<and> ui \<noteq> TcbSetTLSBaseIntent; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x y. x = translate_tcb_invocation y)) (\<lambda>_. True) (\<lambda>_. True) (case ui of TcbReadRegistersIntent suspend flags count \<Rightarrow> returnOk (cdl_tcb_invocation.ReadRegisters (cap_object cap) suspend 0 0) \<sqinter> throw | TcbWriteRegistersIntent resume flags count regs \<Rightarrow> returnOk (cdl_tcb_invocation.WriteRegisters (cap_object cap) resume [0] 0) \<sqinter> throw | TcbCopyRegistersIntent suspend_source resume_target f1 f2 f3 \<Rightarrow> doE (source_cap, uu_) <- throw_on_none $ get_index excaps 0;
source_tcb <- case source_cap of TcbCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw;
target_tcb <- returnOk $ cap_object cap;
returnOk (cdl_tcb_invocation.CopyRegisters target_tcb source_tcb suspend_source resume_target f1 f2 0)
odE \<sqinter> throw | TcbSuspendIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Suspend (cap_object cap)) \<sqinter> throw | TcbResumeIntent \<Rightarrow> returnOk (cdl_tcb_invocation.Resume (cap_object cap)) \<sqinter> throw | TcbConfigureIntent fault_ep cspace_root_data vspace_root_data buffer \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
buffer_frame <- throw_on_none $ get_index excaps 2;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) buffer_frame_opt)
odE \<sqinter> throw | TcbSetIPCBufferIntent buffer \<Rightarrow> doE buffer_frame <- throw_on_none $ get_index excaps 0;
buffer_frame_opt <- returnOk $ if buffer \<noteq> 0 then Some (reset_mem_mapping (fst buffer_frame), snd buffer_frame) else None;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None buffer_frame_opt)
odE \<sqinter> throw | TcbSetSpaceIntent fault_ep cspace_root_data vspace_root_data \<Rightarrow> doE cspace_root <- throw_on_none $ get_index excaps 0;
vspace_root <- throw_on_none $ get_index excaps 1;
cspace_root_cap_ref <- returnOk $ (cdl_update_cnode_cap_data (fst cspace_root) cspace_root_data, snd cspace_root);
vspace_root_cap_ref <- returnOk $ vspace_root;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot (Some fault_ep) (Some cspace_root_cap_ref) (Some vspace_root_cap_ref) None)
odE \<sqinter> throw | TcbBindNTFNIntent \<Rightarrow> doE (ntfn_cap, uu_) <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) (Some (cap_object ntfn_cap)))
odE \<sqinter> throw | TcbUnbindNTFNIntent \<Rightarrow> returnOk (cdl_tcb_invocation.NotificationControl (cap_object cap) None) \<sqinter> throw | TcbSetTLSBaseIntent \<Rightarrow> returnOk (cdl_tcb_invocation.SetTLSBase (cap_object cap)) \<sqinter> throw | _ \<Rightarrow> doE auth_cap <- throw_on_none $ get_index excaps 0;
returnOk (cdl_tcb_invocation.ThreadControl (cap_object cap) slot None None None None)
odE \<sqinter> throw) (case gen_invocation_type label' of TCBReadRegisters \<Rightarrow> decode_read_registers args' cap' | TCBWriteRegisters \<Rightarrow> decode_write_registers args' cap' | TCBCopyRegisters \<Rightarrow> decode_copy_registers args' cap' $ map fst excaps' | TCBConfigure \<Rightarrow> decode_tcb_configure args' cap' slot' excaps' | TCBSetPriority \<Rightarrow> decode_set_priority args' cap' slot' excaps' | TCBSetMCPriority \<Rightarrow> decode_set_mcpriority args' cap' slot' excaps' | TCBSetSchedParams \<Rightarrow> decode_set_sched_params args' cap' slot' excaps' | TCBSetIPCBuffer \<Rightarrow> decode_set_ipc_buffer args' cap' slot' excaps' | TCBSetSpace \<Rightarrow> decode_set_space args' cap' slot' excaps' | TCBSuspend \<Rightarrow> returnOk $ tcb_invocation.Suspend $ obj_ref_of cap' | TCBResume \<Rightarrow> returnOk $ tcb_invocation.Resume $ obj_ref_of cap' | TCBBindNotification \<Rightarrow> decode_bind_notification cap' excaps' | TCBUnbindNotification \<Rightarrow> decode_unbind_notification cap' | TCBSetTLSBase \<Rightarrow> decode_set_tls_base args' cap' | _ \<Rightarrow> throwError IllegalOperation) proof (prove)
goal:
No subgoals!